Many large organisations
inadvertently, with reasonable intentions create a structure with a powerful bias towards inaction.
It's reasonable, when a company is looking into buying a new SaaS product, that the legal team review the contract.
It's reasonable for legal to ask for variations in the contract, if there's something in it they can't approve.
It's reasonable for the product to be reviewed for compliance with our privacy laws, before we order employees to start using it.
It's reasonable that the information security team get to be consulted before a new product is adopted, we don't want insecure products sneaking in.
It's reasonable that we want single-sign-on from our vendors, that's good for security. And we want SOC2 compliance if possible, as we're trying to be SOC2 compliant ourselves.
It's reasonable that a vendor have a record in our finance database, so we can pay them and know who we've paid what.
It's reasonable that, before approving a vendor, we get a statement from them that they do not use slave labour in their supply chain.
It's reasonable that every expense be attributed to a project or department within the business.
It's reasonable that the project or department's budget have an owner, who has to approve major expenditures.
It's reasonable that the work above is split across quite a few teams, and that each team have a queue of work where non-emergency requests can take a week or two.
But take those reasonable policies together, and it takes 3-6 months to adopt a new SaaS product - so it's a heck of a lot easier to stick with an under-performing, over-priced vendor than it is to get a new vendor approved.