Your Board Thinks You Know What's Happening Across Your Business. But Can You Prove It?

When every report is correct and the answer is still missing

The board pack went out on time. Revenue looks healthy, the accounts reconcile, and every dashboard in the appendix is a comfortable green. Forty minutes in, a non-executive director leans forward with a slightly too-simple question: "How much are we spending on software across the business, and how much of it are we using?"

Nobody in the room is unprepared. Finance has the invoices. Procurement has the contracts, and IT has the application inventory. Each of them could answer their own part accurately, today. None of them can answer the question that was asked.

So someone promises to come back with the numbers. The meeting moves on, but the question stays in the room, along with a few quieter ones.

"If it's this hard to answer one basic question, what else don't we know?"

"The AI policy exists. I couldn't tell you which tools it covers this month."

"Most of this pack is probably right. I just can't say which parts."

If any of that sounds familiar, you're not alone, and nobody in that room is failing at their job. Every report was correct. The problem sits between them. Comparing one department's records against another's appears in nobody's objectives. So the space where the money and the risk actually live belongs to no one.

Why a clean audit doesn't mean your AI governance is working

The common belief makes sense. You've had the audit and completed the ISO 42001 gap assessment. The GRC platform is in place and the board approved the AI policy. Each of those took real effort, and the people behind them did good work.

Compliance asks whether you did what you said you would do. Governance asks whether what you said is still true. An assessment describes your organisation on the days the fieldwork ran. A licence lapses the week after. Someone starts using an AI tool over lunch, and it never reaches the register. The document stays accurate to a date that has already passed.

That is why the belief is dangerous. The more you've invested in governance, the more confident the declaration becomes, and the less likely anyone is to test it.

A green status reporting a belief and a green status reporting a fact look identical on the page.

Why another dashboard, platform or assessment won't close the gap

Look at what each tool is designed to check. A dashboard reads a status field someone set while the evidence was still current. An audit samples controls on the fieldwork date. A GRC platform counts completed assessments, and a cost-reduction programme can only cut spend someone has already mapped.

Every one of them checks a piece against a rule. None of them, as standard, joins the purchase record to the licence data, the usage logs and the HR leavers list. Joining is harder than checking. So it happens once, by hand, when someone senior asks a pointed question, and then it stops.

Each new layer adds distance between you and the facts. What you need is the proof you already hold, finally on the same table.

Why I wrote this book

I nearly lost my own business doing exactly what I had spent years warning clients about.

At IDS we had demand and a healthy pipeline, so I hired people and grew the cost base ahead of the revenue. Each decision made sense against the forecast in front of me. Then the timing shifted. Utilisation slipped a little. Deals I'd counted as likely drifted back towards possible, and margin narrowed customer by customer without any single account falling off a cliff.

I could see every one of those signals. I never put them side by side. IDS had been on a path to £300,000 EBITDA and was heading towards minus £150,000, a swing of nearly half a million pounds. It cost me difficult nights. Worse, it meant sitting across from people I had hired, people with mortgages and families, and telling them the situation had changed.

Every figure I looked at was accurate. The business was still heading somewhere none of them described. That was when I understood that a leader's confident picture of their own business is just another declaration until someone tests it against the records.

When I finally ran my own method on IDS, it came back towards that £300,000. I wrote The Reality Gap so you can see your gap months earlier than I saw mine, while the useful choices are still open to you.

Why joining the records you already hold shows what no single report can

Put departmental records side by side and the gaps become visible, priced and owned.

Every organisation carries three accounts of itself. Declared reality is what it believes is happening: the registers, status reports and confident answers in meetings. Expected reality is what your contracts, regulations and policies say should be happening. Observed reality is what the records show about who logged in, what was paid and which control evidence is current.

The gap is wherever those three stop agreeing. Reading any one of them alone will never show it to you. Most organisations have simply never laid them next to each other.

How the Observed Reality Framework tests governance claims against your records

The Observed Reality Framework puts connected evidence behind the governance frameworks you already use, including ISO 42001. It compares declared, expected and observed reality, then turns each material gap into a decision your board can actually make. It gets to the root because it tests each claim against the records instead of asking someone to restate it.

The 5 steps to answering your board with evidence.

How joining three sets of records exposed up to £400,000 in unused licences

The organisation paid for 2,000 licences on a single platform. Its software asset register had board-level sign-off. Finance had paid every invoice correctly, and IT had allocated licences the way it always had. Nobody had compared those records with the platform's own activity data or the HR leavers list.

Once they were joined, roughly 1,200 people turned out to be regularly active. Around 800 licences appeared to belong to people who had already left. At £500 a licence, that came to up to £400,000 a year, and the renewal was four months away.

Nothing about the people or the processes had changed. The board could now see the gap, the range and the workings with time still on the clock. It made a decision instead of opening an investigation.

What leaders say after the records are joined

One leadership team did the hard part. They pulled their records, compared them and handed the CEO seventy-three findings. All of them were real, and every one could be defended. The CEO asked which ones mattered.

Once the list was ranked by recoverable cost and risk exposure, seventy-three became five, each with a figure, a formula and a named owner.