None of these decisions arrive with a deadline. Nobody schedules them. They get made by default, usually by whoever happened to be available that week, and then they hold for years.
By the time a company reaches roughly fifty people, the accumulated defaults have started to set a ceiling: on how quickly it can bring someone on, how long the month-end close takes, how confidently it can answer a customer's security questionnaire. The technology is rarely the problem. The unmade decisions are.
These are the five we find most often, roughly in the order they begin to bite.
1. Who holds the administrator accounts
At twenty people, one person knowing every password is efficient. At fifty it is a single point of failure with a salary. The question is not whether you trust them, because you almost certainly should. The question is whether the company can operate for two weeks without them, and whether anyone else could prove who changed what.
The fix is unglamorous. Inventory every system, record which account owns it, name a second owner for each, and move shared credentials into a password manager with an audit trail. Where a vendor portal only allows one administrator, write down who it is and what happens if they are unreachable. This takes a couple of days and it is the cheapest resilience you will ever buy.
There is a second-order effect worth naming. Once ownership is written down, you can see how many systems nobody owns at all: the analytics account created for a campaign, the domain registrar in a founder's personal email, the file-sharing tenant a department signed up for on a card. Those are the ones that go wrong quietly, because there is no one to notice.
2. Whether identity is a system or a habit
Most companies this size accumulated their tools one at a time, each with its own login. Onboarding became a list somebody remembers. Every new application quietly widened the number of places a password could leak from, and nobody has a complete picture of who has access to what.
The decision is to treat identity as infrastructure: one directory, single sign-on wherever the application supports it, multi-factor authentication everywhere without exception, and access granted by role rather than by request. It is the change with the widest blast radius on this list, which is why it is worth doing while the company is still small enough for the migration to be measured in weeks.
Every one of these is a management decision wearing technical clothes.
The objection we hear is that single sign-on costs more, because several vendors charge for it. Sometimes that is true and the answer is to check which applications hold anything worth protecting, and to start there rather than everywhere. What does not work is deciding by price alone and then discovering, during a security questionnaire, that half your systems cannot report who has access to them.
3. Where the numbers come from
Three departments, three revenue figures, and a monthly meeting that spends its first twenty minutes reconciling them. This is almost never a tooling problem. It is the absence of an agreed definition: what counts as revenue, on what date, net of what.
Pick one definition per metric and one system that is the source for it. Write both down. Then make the reports read from that source, even if the first version is plainer than what people had built in spreadsheets. Companies that skip this step and buy a dashboard tool instead end up with the same disagreement rendered more attractively.
The decision is harder than it sounds because it takes something away. Whoever built the spreadsheet has been carrying that reporting on their own time, and standardizing it makes their version wrong in public. Say out loud that the old numbers were not incompetent, they were undefined, and that the definition is now a management artifact rather than a personal one.
4. What happens when someone leaves
Departures are the moment every earlier shortcut becomes visible at once. Access sits open because nobody has the list. A laptop is somewhere. A mailbox holds the only copy of a client conversation. Something only that person knew how to run comes due the following Tuesday.
A leaver process is one page: accounts to disable and in what order, devices to recover, mailbox and file handling, and a short handover of anything only that person could do. Run it the same way every time. Most companies discover the gap during an audit, or after a departure that ended badly, which is a costly way to learn what could have been a page of text.
- Disable the directory account first, so single sign-on revokes the applications behind it in one step.
- Handle the exceptions second: anything with a local login that the directory does not cover.
- Convert or delegate the mailbox rather than deleting it, and record who now holds it.
- Recover the device, wipe it, and put it back in the inventory rather than in a drawer.
- Capture the handover before the last day, not on it.
The same page covers the joiner and the mover, which are the other two-thirds of the problem. Most access sprawl does not come from people leaving. It comes from people changing roles and keeping everything they had before.
5. Who owns the roadmap
The default answer is nobody, and vendors are happy to fill the vacuum. Renewals arrive, each is judged on its own, and the company drifts into an architecture no one chose. Two years later the systems disagree with each other and every proposed change touches four contracts.
Someone has to hold a twelve to twenty-four month view, review contracts before they auto-renew, and be able to say no with a reason. At this size that is rarely a full-time hire. It is usually a few hours a month of senior attention, plus a written decision log so the reasoning outlives the person who made it.
The decision log matters more than the roadmap. Roadmaps go out of date on contact with the business. A record of what was chosen, what was rejected, and why, keeps the next decision from starting at zero, and it saves the argument you have already had from being had again in a year.
Where to start
Take them in the order above. Administrator ownership and identity are the two that make everything after them cheaper, and both can be improved without a project. The reporting definitions need a management decision more than an engineer. The leaver process is a page. The roadmap is a standing hour on someone's calendar.
None of this requires new software, which is why it tends not to get done. There is no vendor whose job it is to sell you a decision. The work is unglamorous, it competes with whatever is on fire this week, and the payoff shows up as things that do not happen: the departure that does not become an incident, the questionnaire answered from a document, the renewal that gets read before it signs itself.
If you recognize three or more of these, the constraint is not budget and it is not the technology you chose. It is that no one has been given the job of deciding. That is a smaller problem than it looks, and it is fixable in a quarter.