Biyi Adeniran, director at ISSEC, has worked across engineering, IT, audit, compliance and operations, and across industries from oil and gas to healthcare. After over three decades, his conviction is that governance is a trust problem, and most organisations are solving the wrong one.
Biyi Adeniran grew up in a teacher's household in Nigeria. His father taught history, which meant that learning about the world was not optional. By the time he arrived in Kenya, he had been reading about East Africa for years and following the M-Pesa story closely, partly because his team in Nigeria had been among the first to run mobile banking through SMS. What he found when he got here confirmed what he already suspected.
"All humans are the same all over the world. It is a global phenomenon that we think bad things cannot happen to us, and that compliance exists because those bad people just want to give us work and make things difficult. What we coach our partners on is how these things contribute to business success. And the operational value they can derive from these activities, rather than just doing them because someone said you have to," he says.
The Canadian national is a director at ISSEC, where he has spent the last five years working with clients across the globe on digital trust and technology adoption. Although his background is engineering, he has not practised in more than two decades. He moved into IT and later into project management, after which governance found him. He put his hand up for the challenges in those areas and they turned into job opportunities across GRC, cybersecurity, process improvement and efficiency optimisation. Biyi describes himself as a digital trust and adoption leader, a title he chose deliberately.
"I've worked across different industries: oil and gas, aviation, travel, hospitality, financial services, telecoms, healthcare. When someone describes me from far, they go: this is a man of many parts," he says.
At ISSEC, Biyi is particular about how the firm describes itself, saying it is not an IT company. The distinction matters to him because it is at the heart of what he believes the work is actually about. Clients often come with problems and objectives, and the company’s job is to help them see how to use their existing resources to address those problems and achieve those objectives. The challenges vary multiple times a day, and this is precisely what keeps the adrenaline flowing. The sense of fixing problems that others think are unsolvable, and fixing them in an optimal way rather than simply throwing money at them, is what has kept him at the firm and what will continue to keep him.
The whole story
Working across industries and countries has sharpened one insight above all others. Technology, Biyi argues, is never the whole story. It exists within an ecosystem that shapes everything about whether it succeeds or fails. Governance on the other hand, is about doing the right things, the right way, at the right time, to derive the most value. As Biyi sees it, most organisations never get there because they are too busy treating it as a compliance checkbox.
"Technology is the same in terms of nuts and bolts. Working across different regions, cultures and countries has taught me that it is about understanding the context of the business, the organisation, the society in which the engagement is occurring, and then leveraging that to ensure technology is used the right way," he says.
When ISSEC begins an engagement, particularly with organisations managing data privacy, compliance or fraud mitigation across multiple entities, the first order of business is understanding what the organisation is actually trying to do. That means understanding the value of the data it holds, the context around it, the risks it is exposed to in its regulated environment, and where the current gaps are. From there, the team builds a roadmap. Prioritising is central to that process, because resources are finite. As Biyi notes wryly, even when resources are not finite, “the day is still 24 hours”. The approach is to take what can be addressed one chunk at a time and then scale.
The ISSEC team usually observes, listens and asks questions before proposing anything. The goal is to build a solution with the client rather than for them, because the client will have to own and operate it long after the engagement ends. Biyi calls it co-creation, and he is clear about why ownership is the point.
"Based on that, we then ask ourselves how we might address the problem and achieve the goal. And then we work together to create the solution. They own it, so they need to operate it," he says.
Understanding operations
For CFOs trying to make the internal case for GRC investment, particularly when that decision sits above them, Biyi's counsel is to lead with value rather than cost. In his experience, the conversations that fail start with what the infrastructure will cost, while those that land begin with what the GRC processes contribute to the organisation.
"We help CFOs really develop that story. It is not about the infrastructure, because infrastructure is just a means to an end. The conversation moves from 'I need this money’ to 'we are creating this value, it is costing us X to execute, and we are looking to optimise that by investing in either infrastructure or a solution,'" he says.
With more than three decades in the field, the capability Biyi rates most highly in a finance function has nothing to do with financial statements. He distinguishes this from what an MBA delivers. The insight, he reveals, comes from proximity to the work itself rather than any classroom.
"It is not about financial statements, not about debit and credit. It is about understanding the operations and the market that the organisation is in, and understanding the motivations of the various stakeholders in that market. You could say business savvy, but I don't want to use that phrase. It is something more specific than that," he says.
