Trust is often spoken about in boardrooms as if it were an output, something that emerges from doing the right things consistently over time. It appears in strategy documents and investor communications as both a differentiator and an aspiration. Yet in businesses built on digital infrastructure, particularly in financial services, trust is less an outcome and more a function of design. It is created, or undermined, by the systems that support how an organisation operates at scale.
That is where a more difficult reality begins to surface. Many organisations are attempting to scale trust without having a sufficiently clear view of the risks embedded in their own systems. They rely on governance structures that appear robust on paper, with policies, controls, committees, and reporting lines, yet these do not always translate into a coherent understanding of how risk behaves in practice. Documentation can create comfort, but it is not the same as visibility.
This distinction becomes critical as a business grows. At a smaller scale, weaknesses in systems and processes can be managed informally. Teams compensate for inefficiencies, institutional knowledge fills gaps, and issues are resolved before they escalate. However, growth changes the equation. As customer volumes increase, as platforms become more interconnected, and as data flows expand across functions and borders, those same weaknesses become harder to detect and more difficult to control. What was once manageable begins to fragment.
In that environment, the question facing boards is not whether the organisation is compliant. Most are, at least in a formal sense. The more relevant question is whether the organisation understands where its data risk sits, how that risk might evolve under pressure, and what the consequences would be if key assumptions failed. These are not questions that can be answered solely through periodic reporting. They require a deeper, more integrated view of how the business actually functions.
Part of the challenge lies in how data risk is distributed. Responsibility is typically shared across multiple areas. Technology manages systems. Legal interprets obligations. Compliance monitors adherence. Business units drive usage. Each has a legitimate role, but none has a complete perspective. Without deliberate effort, this creates a form of fragmentation in which risk is acknowledged in parts but not fully understood as a whole. The result is a subtle but significant form of exposure, not a lack of effort, but a lack of alignment.
Boards can find themselves receiving assurances that reflect intention rather than reality. Controls may exist, but their effectiveness under pressure is less certain. Processes may be defined, but the extent to which they are followed in practice can vary. The organisation appears controlled, yet its ability to withstand stress has not been fully tested. This is where confidence can become misplaced.
The implications are not theoretical. In a digital environment, failures related to data, whether operational, regulatory, or reputational, tend to surface quickly and visibly. They affect customer experience directly and can alter perceptions of reliability in ways that are difficult to reverse. Trust, in this context, is not lost gradually. It can be eroded in a single incident that reveals underlying weaknesses.
None of this suggests that organisations should temper their ambitions for growth. On the contrary, the ability to scale effectively is central to long term success. However, growth without clarity introduces a level of fragility that is often underestimated. It is not growth itself that creates risk, but the interaction between growth and systems that have not been designed to operate at that scale.
From a governance perspective, this requires a shift in emphasis. Boards need to move beyond a reliance on formal compliance and focus instead on the quality of insight they have into the organisation’s risk landscape. This includes a clearer understanding of where data is most critical to value creation, where dependencies are most concentrated, and where visibility is weakest. It also requires more explicit ownership of risk, so that accountability does not become diluted across functions.
Perhaps most importantly, it calls for a different kind of questioning. Rather than focusing on whether frameworks are in place, boards should be asking how the organisation would respond under stress. What would fail first? Where are the blind spots? How confident can they be that the picture they are seeing reflects the reality of operations?
These are not technical considerations. They are central to the role of the board in overseeing the long term resilience of the organisation.
Trust, in the end, is not built solely through intention or communication. It is sustained through the consistent performance of systems that operate as expected, even when conditions are challenging. Where those systems are not fully understood, trust rests on uncertain foundations.
An organisation that can see its risks clearly is in a position to manage them, to make informed trade offs, and to grow with confidence. One that cannot is, to some extent, operating on assumption.
And assumption is a fragile basis on which to scale anything, least of all trust.
- business a.m. commits to publishing a diversity of views, opinions and comments. It, therefore, welcomes your reaction to this and any of our articles via email: comment@businessamlive.com
Michael Irene, CIPM, CIPP(E) certification, is a data and information governance practitioner based in London, United Kingdom. He is also a Fellow of Higher Education Academy, UK, and can be reached via moshoke@yahoo.com; twitter: @moshoke
You can’t scale trust if you can’t see risk