Approval happens in chat and email
The final decision, conditions and accountable owner are difficult to reconstruct.
Governance and accountability
Make technology authority, risk and evidence visible.
Kritical helps organisations define who can decide, who must approve, what evidence is required and how exceptions are handled across technology operations and change. The result is an operating governance model—not a claim of legal compliance or independent certification.
On this page
Choose where to start.
Jump to the part that matches the problem or decision in front of you.
Use the arrows or scroll to see every card.
Governance becomes urgent when authority is assumed rather than recorded.
The symptoms are often visible during incidents, audits, large changes or supplier disputes: several people can act, nobody can prove who approved the decision, and evidence is assembled after the event.
Controls exist without an operating owner
A technical setting may be enabled, but nobody owns exceptions, review or evidence quality.
Projects and operations use different rules
A change passes a project gate and then enters an operational environment with no continuing owner.
Decision rights and evidence designed together.
We map the decisions that matter, the people authorised to make them, the technical and business evidence they need, and the conditions requiring escalation. The model can cover architecture, security, access, lifecycle, supplier changes, data, AI and operational risk without pretending one committee should decide everything.
Authority model
Decision makers, approvers, reviewers and operators are explicit.
Evidence model
Each gate states what must be demonstrated, how current it must be and what is not covered.
Exception model
Time-bound exceptions have an owner, reason, compensating action and review point.
Governance has to appear in the systems where work happens.
A document alone does not change behaviour. We scope how decisions, gates and evidence connect to service management, identity, change, development, supplier and reporting workflows, using existing platforms where practical and making manual dependencies visible.
Technical governance support is not legal assurance.
Kritical can design and implement governance processes, technical controls and evidence collection. Legal opinions, formal certification and independent assurance are separate services provided by appropriately qualified parties. We record where they are required rather than absorbing them into a technology claim.
Begin with one decision path and expand from evidence.
A first phase is quoted around an agreed decision path, its owners, current systems and required evidence. The written scope identifies deliverables, non-coverage, dependencies and the conditions for extending the model.
Choose the decision path
Tell us where authority or evidence breaks down today. We scope a bounded governance engagement.
Questions before you enquire
Is this a compliance certification?
No. Kritical can help implement governance and evidence processes. Formal certification, legal advice and independent assurance remain separate.
Do we need a new governance platform?
Not necessarily. We first map the decisions and evidence, then determine whether existing service, identity, development or reporting systems can support them.
Can this cover suppliers and outsourced services?
Yes. Supplier responsibilities, evidence, escalation and exceptions can form part of the governance model where they are in scope.
How does this differ from AI governance?
IT governance covers technology authority and evidence broadly. AI governance applies additional ownership, lifecycle and supervised-execution requirements to AI use cases.
Related services
AI governance
Kritical helps you work out who owns each AI use case, how it gets approved and what evidence you keep.
Information governance
Make sensitive information easier to find, share and protect.
IT policy packs
Kritical prepares practical IT, IT operations and IT security policy foundations, then helps adapt them to the way your organisation works.
IT management
IT management sits above the helpdesk and the project list.
Security readiness
Frameworks are useful when they help you decide what to protect, which gaps matter and what evidence should exist.
Let’s define the next step.
Tell us what you want to achieve, what you have today and when it matters.