Sheet 02
First 90 days
Three windows, in this order for a reason. Standing up governance before understanding what people are already doing produces a process that describes an imaginary organization, and everyone routes around it. The listening comes first because in a decentralized firm the program's credibility in month six is decided in month one.
The shape of it
- 01Days 1–30
Listen and map
5 focus areas, 5 deliverables, 3 named risks
- 02Days 31–60
Organize and align
6 focus areas, 6 deliverables, 3 named risks
- 03Days 61–90
Pilot and measure
5 focus areas, 6 deliverables, 3 named risks
Counts read from the plan below rather than typed in, so the summary cannot drift from the detail.
The plan
Every window names what it produces, who it involves, how success would be recognized, and what could go wrong inside it.
Days 1–30
Listen and map
Find out what is already true before proposing anything. In a decentralized firm the program's credibility in month six depends almost entirely on whether people felt heard in month one.
Focus
- 01
Meet the people who will make or break this
Structured conversations across Technology, Security, Risk and Legal, Data, HR, Marketing, Finance, Operations, and every practice group. Same five questions each time so patterns are comparable: what are you already doing with AI, what would help, what worries you, who else should I talk to, and what has been tried before that did not work.
- 02
Inventory what exists
Tools in use and tools quietly expensed, active pilots, informal practices, existing policy language, training already delivered, contracts and renewal dates, and the people who have appointed themselves the local expert. The informal practices matter most — they show where the real demand is.
- 03
Map decision rights as they actually work
Not the org chart. Who genuinely decides on security exceptions, vendor contracts, client data handling, and employment process changes — and where those decisions get made. Governance that ignores the real path gets routed around.
- 04
Identify risk, duplication, and quick wins
Anything actively risky gets raised to the accountable owner immediately, not saved for a 90-day presentation. Duplicated effort across offices is usually the easiest early win: two teams solving the same problem separately is a relationship opportunity, not a scolding.
- 05
Establish a baseline
Current adoption, license utilization, training completion, known use cases, and open risks. Without a baseline in the first month, every later claim of progress is unfalsifiable.
Deliverables
- Stakeholder map with decision rights and escalation paths
- Initial AI tool and vendor inventory, including tools nobody formally approved
- Draft use-case register seeded from what is already happening
- Baseline measurement snapshot with the date it was taken
- Short list of immediate risks routed to their owners
Stakeholder touchpoints
- Weekly 1:1 with the Director of Technology
- Introductory meetings with each shared services leader
- Listening sessions in each practice group, ideally including a non-headquarters office
- Coffee with the people already doing this informally — they become the champion network
How I would know it worked
- Every function has met the program manager and knows what the role does and does not decide
- A written inventory exists where none did
- At least one duplicated effort identified and the two teams introduced
- No surprises: anything risky is already with its owner
What could go wrong in this window
- Arriving with a framework instead of questions
- Being read as an auditor — the first conversations set that perception for a year
- Over-indexing on headquarters and missing how remote offices actually work
Why the sequence is this way round
Decentralized by design: practice groups control their own delivery work and budgets, shared services set firmwide standards, and almost nothing moves by mandate. The operating model below assumes influence, not authority.
A plan that opens with a governance framework assumes authority the role does not have. This one opens with listening because the intake process people actually use is the one built out of what they told you in the first month — and because anything genuinely risky found in week two gets raised to its owner immediately rather than saved for a day-90 presentation.