It can be either a sobering or enlightening moment when you read through a new IT assessment; it can confirm your fears or show you opportunity you’d never realised existed, but what should you do next?
The answer is not “Do nothing.”, but organisations can find themselves tied up in the minutiae of the report and not consider the next steps.
The first step is to have a conversation with the author. While the report itself will dive deep into the detail of each item that’s been considered, placing that into context and understanding what the context means for the business is key to the next step; prioritisation.
Use the assessment to make decisions
A good IT assessment tells you what is happening across your technology environment, where the risks sit, where capability is missing and where you have opportunities to improve.
Your next task is to decide what those findings mean for the business and what you are going to do about them.
An assessment looks at technology through a technology lens. You add value to that assessment by using a business lens to prioritise and sequence the findings.
That distinction matters.
A recommendation to replace a core system may be entirely valid, but less urgent than completing an acquisition integration. Modernising your infrastructure may make sense, but not ahead of a product launch that determines the next stage of growth. Improving an internal process may deliver significant long-term benefits, but still need to wait while you address a more immediate operational risk.
Do not work through the report from page one to the end.
Use it to decide what needs to happen now, what should happen next and what can safely wait.
That is where the assessment starts creating value.
Start with what the business is trying to achieve
Before you prioritise individual findings, remind yourself what the business is trying to accomplish:
- Are you trying to grow?
- Improve margins?
- Prepare for investment or sale?
- Integrate an acquisition?
- Enter a new market?
- Improve customer service?
- Reduce operational risk?
Your priorities should shape the technology plan.
If growth matters most, focus on the technology constraints that limit your ability to onboard customers, expand capacity or release new products.
If margin improvement matters most, look closely at automation, supplier costs, licensing and operational efficiency.
If you are preparing for investment or a transaction, give greater attention to governance, security, resilience, intellectual property and technical debt.
This is why the conversation with the assessment author matters. Do not just ask them to repeat what is in the report. Ask them what each finding means for the business, what happens if you defer it and what other work depends upon it.
Those answers help you turn a set of findings into a sequence of decisions.
Do not let short-term business priorities hide technical problems
Using a business lens does not mean ignoring technical needs that lack an immediate commercial return.
Some of your most important technology problems may remain largely invisible until they fail.
A system can continue working while becoming progressively harder and more expensive to maintain. A development team can keep delivering while technical debt slows every new release. A critical process can continue operating while depending entirely on one person. A supplier can appear to be performing well while leaving you without adequate contractual protection or a credible exit route.
You need to give those issues proper weight.
Ask a second question alongside “What business outcome does this support?”
Ask, “What happens if we leave this alone?”
That question often changes the priority.
Some technical problems become disproportionately expensive once you have deferred them for too long. Others reduce your future options or make every subsequent change harder.
Good prioritisation balances today’s business needs with tomorrow’s technology constraints.
Put security and resilience ahead of almost everything else
Security and business continuity and disaster recovery need different treatment.
Prioritise them above almost everything else.
That does not mean implementing every conceivable security control or spending without limit in pursuit of theoretical perfection. It means addressing material risks to the confidentiality, integrity and availability of your business before you spend time on lower-value improvements.
If the assessment tells you that users have inappropriate access, sensitive data is poorly protected, critical systems are not backed up properly, or you do not have a credible recovery plan, act on those findings.
Do not place them into a general backlog alongside routine technology improvements.
The same applies if nobody can tell you whether your backups can actually be restored, how long recovery would take, who takes control during an incident or which systems need to come back first.
Backup on its own is not a recovery strategy.
A collection of security products is not a security strategy.
You need to know what could materially harm the business, what controls reduce that risk and whether those controls will work when you need them.
You can choose to defer an application replacement for another year.
You should be much less comfortable deferring the discovery that you could not recover from ransomware, significant data loss or the failure of a critical supplier.
Turn the report into a sequence, not a shopping list
Once you understand the business priorities and the technical risks, turn the assessment into a plan.
Do not simply copy every recommendation into a programme backlog.
Sequence them.
Identify the actions that immediately reduce risk.
Identify the work that creates foundations for everything else.
Identify dependencies.
Separate the improvements that genuinely move the business forward from those that are useful but can wait.
You may need to improve identity management before rolling out new collaboration tools. You may need to fix data quality before investing in AI. You may need better technology governance before committing to a major platform replacement.
This is where the assessment becomes strategically useful.
Instead of saying:
“We have 37 recommendations.”
You want to be able to say:
“These are the five things we need to do first.”
“These three changes unlock the next stage of our strategy.”
“These risks need to come down before we invest elsewhere.”
“These issues matter, but we can safely defer them.”
That gives your leadership team something they can act upon.
More importantly, it gives them confidence that the business is making deliberate technology decisions rather than reacting to a list of technical observations.
Be realistic about what you can deliver
Do not confuse having 30 recommendations with having the capacity to deliver 30 changes.
You probably do not.
Trying to tackle everything at once usually creates more risk rather than less. Teams become overloaded. Projects compete for the same people. Suppliers receive conflicting priorities. Business stakeholders spend so much time supporting change that they struggle to run the business itself.
Choose what you are actually going to deliver.
That may mean doing fewer things.
It may mean spreading work over several quarters.
It may mean bringing in external expertise for specific areas while keeping your internal teams focused on the work where they add the most value.
And it may mean deliberately accepting some risks for a period of time.
That is fine, provided you make that decision consciously, a risk that you understand and choose to accept is very different from a problem that everyone simply forgot about.
Give every priority an owner
Once you decide what matters, give somebody responsibility for making it happen.
Without ownership, your roadmap will become another document.
The owner does not have to perform all the work themselves. They need to make sure the outcome happens.
They need to secure resources, coordinate suppliers, manage dependencies, resolve obstacles and report progress.
For larger businesses, an existing technology governance or programme structure may already provide that accountability.
For smaller and mid-sized organisations, the assessment can reveal that this leadership capability is exactly what is missing.
You may now know what needs to change but still lack someone with the time, experience or authority to drive it through.
That is the point where planning needs to become leadership.
An example roadmap, organised by business outcome and prioritised to balance resourcing and progressively deliver value in a predictable and measurable way.
Make the pivot from planning to action
An assessment gives you better information and you create the value by acting on it.
Once you have agreed the priorities, understood the risks, identified the dependencies and assigned ownership, stop analysing and start delivering.
This pivot is where many organisations lose momentum.
The people who commissioned the assessment already have full-time roles. Your internal technology team may be excellent at running day-to-day services but lack the capacity to lead a wider change programme. Your senior leadership team may understand the business priorities but not feel confident challenging technical recommendations, suppliers or investment decisions.
If nobody takes responsibility for turning the roadmap into action, even an excellent assessment will gradually lose its value.
You need someone to maintain momentum, make decisions and keep technology aligned with what the business is trying to achieve.
Use fractional technology leadership when you need it
You do not necessarily need to recruit a permanent CIO or CTO to achieve that.
A fractional CIO or CTO can take the findings from your assessment and turn them into an executable programme.
They can work with your leadership team to agree priorities, build the technology roadmap, establish governance, engage suppliers, support procurement, oversee security improvements and help your internal technology leaders deliver programmes that would otherwise compete with their day-to-day responsibilities.
Crucially, they provide continuity between the decision and the outcome.
They keep asking whether the agreed actions are happening, whether circumstances have changed and whether the decisions you made six months ago still make sense today.
That is not simply technology management.
It is technology leadership.
And its purpose is to give you confidence that you are making the right technology decisions and that those decisions are turning into meaningful action.
From assessment to action
At DigitalTeddy, we carry out technology assessments to help you understand where you are, where your risks lie and where technology can create greater value.
But we do not believe the assessment should be the end of the engagement.
We can help you take the findings, decide what matters most and turn them into a prioritised roadmap.
Where you need more than advice, we can also provide fractional CIO or CTO leadership to take that roadmap into delivery.
That might mean helping your leadership team decide what to do next. It might mean leading a programme, managing suppliers or providing executive-level technology leadership while your internal teams focus on running the business.
The goal is not to create more technology activity.
It is to make sure you are doing the right things, in the right order, for the right reasons.
If you have recently received an IT or technology assessment and are wondering what to do next, talk to us.
We can help you move from assessment to action, with confidence that you are making the right technology decisions.