KPMG Delivered Risk-and-Control EA for the CIO. Why Can’t the CEO See the Decision Trace?

The issue is not whether KPMG delivered EA. The issue is whether that EA helps the CIO operate better and helps the CEO trace one real business decision from strategy to operations.

Many large enterprises and government institutions have worked with KPMG or similar consulting firms on Enterprise Architecture, governance, risk, controls, compliance, audit readiness, technology advisory, operating model, process improvement, and transformation support.

The work may have produced serious deliverables.

EA framework. Governance model. Architecture principles. Control views. Risk views. Compliance mappings. Capability maps. Application views. Technology views. Operating model recommendations. Transformation roadmaps. Architecture review structures. Audit and assurance documentation. Technology modernization guidance.

The CIO may have received useful visibility.

IT applications may be mapped. Technology standards may be clearer. Governance may be stronger. Risk and compliance alignment may be better documented. Architecture review may be more structured. Audit evidence may be easier to organize. Modernization priorities may be visible.

But there are two deeper questions.

First:

Is this EA actually helping the CIO perform the P6 operations role with full visibility?

Second:

Can the CEO use this EA to trace one real business decision from strategy to operations?

If the answer is no, the EA may have been delivered. But it has not yet become ICMG Enterprise Anatomy™. That is the gap.

Most EA was delivered for the CIO

This is not a criticism of KPMG. KPMG and similar firms often deliver what they are asked to deliver.

Many EA programs are sponsored through the CIO organization. So the work naturally focuses on the CIO’s needs:

IT portfolio visibility. Application rationalization. Technology modernization. Architecture governance. Risk and control alignment. Compliance traceability. Cyber and resilience alignment. Solution review. Data and integration architecture. Digital transformation support. Audit and assurance support.

These are useful.

But CIO-focused EA is not the same as Enterprise Anatomy.

The CIO may need to know:

Which systems exist? Which platforms are duplicated? Which applications should be rationalized? Which technologies should be standardized? Which controls are linked to which systems? Which projects need architecture review? Which roadmap should IT follow? Which risks are visible to audit and compliance?

The CEO needs to know something different:

Which business decision creates value? Which department owns the outcome? Where does the decision move? Where does it slow down? Where does value leak? Which operational dependency is hidden? Which strategy cannot be executed because the enterprise anatomy is not visible?

That is why EA delivered for the CIO may still not answer the CEO’s question.

But the problem starts even before the CEO. Often, current EA does not add full value even for the CIO.

Why current EA may not even help the CIO’s P6 role

The CIO carries a major P6 Operations responsibility. The CIO must keep technology-enabled services running, monitored, secured, supported, stabilized, maintained, and continuously improved.

That is not a small role. It is not only about projects. It is about daily operational reliability.

Service availability. Incident response. Change control. Platform stability. Security posture. Data reliability. Vendor performance. System resilience. Business continuity. User support. Operational improvement. Cost control. Risk reduction.

So the CIO is not only asking:

What was implemented?

The CIO also needs to know:

Why does this service exist? Which business process does it support? Which policy or rule does it execute? Which department depends on it? Which customer or citizen outcome does it affect? Which component carries the decision? Which change will break which operation? Which hidden dependency creates risk? Which system or sub-system logic is unclear?

This is where current EA often fails. Much of current EA evidence is actually P5-heavy.

It is centered around implementation evidence:

solution designs, application maps, technology standards, integration diagrams, roadmaps, project documentation, implementation plans, platform views, migration plans, architecture review records, delivery governance documents, risk and control documentation.

These artifacts may be useful.

But they usually sit close to P5 Implementation Tasks.

The CIO, however, must operate at P6 Operations. Without P1–P4 visibility, the CIO is trying to run P6 with mostly P5 evidence.

That is why current EA may not be adding full value even for the CIO.

The missing P1–P4 visibility

To operate effectively at P6, the CIO needs visibility into what sits before implementation.

The CIO needs to understand:

P1 Strategy — why the capability, platform, service, control, process, or decision exists.

P2 Process — which business activity sequence it supports.

P3 Systems / Logic — the business system and sub-system logic that governs how the department works. This includes policy logic, rule logic, decision logic, workflow logic, data logic, timing logic, approval logic, exception logic, people coordination logic, partner logic, and where relevant, IT system logic.

P4 Component Specifications — the concrete components that carry or express that logic. These may include forms, templates, role definitions, policy clauses, approval matrices, service rules, operating checklists, reports, dashboards, datasets, screens, APIs, workflows, configurations, training material, contracts, or physical/digital assets.

Without P1–P4, the CIO sees implementation evidence. But the CIO does not see the full anatomy behind what is being operated.

1. That means incidents become harder to diagnose.

2. Change impact becomes slower.

3. Vendor dependency increases.

4. Risk and compliance evidence becomes fragmented.

5. Operational support depends on memory.

6. Architecture reviews become disconnected from real business decisions.

So the problem is not only:

The CEO cannot see the decision trace.

The problem is also:

The CIO cannot get full operational value from EA if EA remains P5-heavy and weak in P1–P4.

The CEO does not need another EA artifact

A CEO does not wake up asking for another capability map.

The CEO asks:

Why is execution slow? Why does a small policy change take weeks? Why do departments interpret the same strategy differently? Why does transformation value disappear between the business case and operations? Why does IT say the system is ready while operations says the process is broken? Why does a cost reduction in one department create risk or revenue leakage somewhere else? Why do we still need meetings, memory, vendor explanations, and old project files to understand impact?

These are not technology questions alone. They are enterprise anatomy questions.

If EA cannot answer them, then the CEO may respect the EA investment but still not use it every day.

The issue is not whether the EA exists. The issue is whether the CEO can see the decision trace.

Decision trace is the missing bridge

Take one real business decision.

A pricing change. A funding approval. A customer onboarding rule. A risk threshold. A regulatory reporting change. A product launch. A subsidy eligibility rule. A service-level commitment. A disbursement trigger. A cost-reduction decision. A compliance control change. An audit remediation decision.

Now ask:

1. Can this decision be traced from strategy to operations?

2. Can leadership see the intended value outcome?

3. Can process owners see the activity sequence?

4. Can business and IT teams see the systems and sub-system logic?

5. Can component owners see the forms, rules, workflows, datasets, reports, screens, APIs, policy clauses, contracts, approval matrices, or configurations that carry the decision?

6. Can delivery teams see the human and IT tasks required to change it?

7. Can operations teams see what must be monitored, supported, corrected, and maintained every day?

If not, the EA may be complete as a consulting deliverable. But it is not yet useful as CEO-level decision visibility.

And it is not yet strong enough as CIO-level operational anatomy.

P1 Strategy is only one perspective

A common mistake is to treat strategy as something above the enterprise.

Strategy is defined. Then operating model is designed. Then initiatives are created. Then governance is installed. Then execution is monitored. Then KPIs are tracked.

This sequence looks logical.

But it creates a separation between strategy and the enterprise body that must execute it.

In ICMG Enterprise Anatomy™, P1 Strategy is one of the six perspectives of ICMG Enterprise Anatomy™. It gives direction and value outcomes.

But it becomes meaningful only when connected to:

P2 Process — the activity sequences through which the department realizes the strategy element.

P3 Systems / Logic — the business system and sub-system logic that governs how the department works. This includes policy logic, rule logic, decision logic, workflow logic, data logic, timing logic, approval logic, exception logic, people coordination logic, partner logic, and where relevant, IT system logic.

P4 Component Specifications — the concrete components that carry or express that logic. These may include forms, templates, role definitions, policy clauses, approval matrices, service rules, operating checklists, reports, dashboards, datasets, screens, APIs, workflows, configurations, training material, contracts, or physical/digital assets.

P5 Implementation Tasks — the work required to create, change, deploy, or improve those components. This includes human tasks within the department and IT tasks supporting that department.

P6 Operations — the daily business operations and IT operations required to run, monitor, support, correct, and maintain the department’s work.

This is where KPMG-delivered EA may need elevation. The artifacts may exist.

But the trace from P1 to P6 may still be incomplete.

One CEO decision moves across many departments

A CEO decision rarely stays inside IT.

1. A revenue decision may move across product, pricing, marketing, sales, channels, customer experience, billing, risk, partners, operations, data, and IT.

2. A cost decision may move across procurement, finance, HR, vendors, legal, operations, service levels, contracts, systems, and support.

3. A regulatory decision may move across compliance, legal, process owners, reporting, audit, data, operations, vendors, and IT.

4. A customer experience decision may move across product, service, support, digital channels, complaints, CRM, analytics, billing, operations, and finance.

5. A risk-control decision may move across policy owners, process owners, control owners, IT owners, audit, compliance, operations, vendors, and reporting teams.

So the decision must be traced across the enterprise functions where it actually moves. That is why ICMG Enterprise Anatomy™ uses the D1–D15 × P1–P6 view.

1. D1–D15 represent the major enterprise functions or departments.

2. P1–P6 represent the six perspectives from strategy to operations.

Together, they create a 90-cell anatomy view. This is not more documentation.

It is a way to see whether the enterprise can make, change, execute, monitor, and sustain decisions without depending on memory.

Why KPMG EA may need elevation

KPMG may have delivered useful EA work.

The governance model may be useful. The risk and control views may be useful. The compliance mappings may be useful. The operating model may be useful. The capability maps may be useful. The process views may be useful.

The technology views may be useful. The roadmaps may be useful. The audit documentation may be useful. The assurance evidence may be useful. The modernization guidance may be useful.

But each artifact must be tested against one question:

Can this help trace one real business decision from strategy to operations?

If yes, it becomes part of the elevated anatomy.

If no, it remains an EA artifact — possibly useful for governance, audit, compliance, or

CIO visibility, but not sufficient for operational diagnosis or CEO-level decision visibility. That is the difference between CIO-focused EA and ICMG Enterprise Anatomy™.

The real value gap

This is not about whether the EA engagement cost $1M, $3M, or $5M. The bigger issue is the value gap it leaves behind.

If the CIO cannot see the P1–P4 trace, IT operations remain reactive, dependent, and harder to diagnose.

If the CEO cannot see the decision trace, the enterprise may still lose value through:

slow change impact analysis, duplicated transformation work, misaligned departments, unclear rule ownership, delayed implementation, hidden operational risk, vendor dependency, manual interpretation, incorrect prioritization, missed revenue, unprotected margin, poor customer experience, regulatory exposure, or weak control effectiveness.

So the issue is not the EA spend. The issue is whether the EA investment became usable for CIO operational clarity and CEO decision visibility. That is the real value gap.

How ICMG elevates KPMG-delivered EA

ICMG does not ask the enterprise to throw away what KPMG delivered. The right move is not to restart EA. The right move is to elevate it.

ICMG examines the existing EA work and asks:

What was delivered? What can be reused? Which artifacts support decision traceability? Which artifacts remain CIO-focused? Which artifacts are mainly P5-heavy? Where does the P1–P4 trace break? Which P1–P6 perspectives are weak?

Which departments are outside the trace? Which parts still depend on meetings, memory, spreadsheets, vendor explanations, or personal interpretation?

Then ICMG selects one real business decision and traces it across:

P1 Strategy, P2 Process, P3 Systems / Logic, P4 Component Specifications, P5 Implementation Tasks, P6 Operations.

Then the trace is extended across the relevant D1–D15 enterprise functions. The result is not another EA report. The result is a visible enterprise decision trace.

It helps the CIO operate with more complete anatomy. It helps the CEO see how decisions create, protect, delay, or leak value.

The board-level question

For a board, CEO, ministry, CIO, CFO, COO, audit committee, risk committee, or transformation leader, the question is not:

Did KPMG deliver EA?

The better question is:

1. Was the EA delivered only for CIO visibility, governance, risk, and compliance — or can the enterprise now see the decision trace?

2. Can the CIO operate P6 with P1–P4 visibility?

3. Can the CEO trace one strategy into process, systems/logic, component specifications, implementation tasks, and operations?

4. Can the CEO see which departments carry the decision?

5. Can the CEO see where value is created, protected, delayed, or leaked?

6. Can the CEO see where execution depends on memory?

If not, the EA may have been delivered. But it has not yet become ICMG Enterprise Anatomy™.

Diagnostic Question

If KPMG delivered your EA for the CIO, can your CIO now operate with full P1–P4 visibility behind the services being run, supported, secured, monitored, and maintained?

And can your CEO now trace one real business decision from strategy to operations across the departments where that decision actually moves?

Can the enterprise see the process, system/sub-system logic, component specifications, implementation tasks, and operations that create, protect, delay, or leak value?

If not, the EA may be complete as a CIO-facing deliverable. But the CIO still lacks full operational anatomy. And the CEO still cannot see the decision trace.