If you work in security or GRC, you’ve almost certainly owned a risk that you weren’t allowed to fix. Your name is on the finding and the remediation plan because no one else wanted to own it. But the authority to actually close that gap belongs to someone two levels up who hasn’t even opened your email yet.
It’s a special kind of infuriating. And according to ISACA’s Tech Workplace and Culture 2026 study, it isn’t handed out equally.
The survey found that women are only slightly less satisfied with their current roles than men are. Decision rights are where you start to see a gap. Sixty-six percent of men believe they have sufficient authority to contribute to company strategy, compared with 53% of women. On personnel decisions it’s 59% to 48%. Purchasing decisions have the widest split, at 52% of men and 32% of women.
While the majority of both men and women report positive experiences overall, women are less likely to be satisfied with workplace culture (52% vs. 65%) and job security (59% vs. 69%). Career progression is closer, at 67% to 73%.
The study doesn’t claim the authority gap drives these other differences, and I won’t pretend it does. But I do think we underestimate how much feeling a lack of authority can erode satisfaction with other facets of your career.
Where it really hurts
Authority is one of the main ways people perceive their future at work. When someone hands you a budget or pulls you into a strategy conversation, they’re telling you something they may never say out loud. We trust your judgment. We plan to keep you around. Take that sign away and people fill the silence themselves – usually with the least flattering explanation available.
It stings even more when your title implies a certain amount of authority. When the title says “Manager” and the approval workflow says “Please ask a grown-up,” the distance between them chips away at trust. It’s hard to feel secure when you can’t make decisions.
Sometimes authority technically exists, but nobody has ever handed it over. The survey measures what people believe about their authority, and belief is ultimately what drives behavior. If someone doesn’t know that they can make the call, they won’t. Take a senior analyst who escalates every low-risk exception because nobody mentioned they could approve those themselves. Their manager reads it as caution. The analyst reads it as distrust. When authority gets communicated informally, it takes on the shape of existing relationships, and that’s how gaps like this one form.
People with the highest risk of walking are often the ones who like their jobs – they’re good at the work and they enjoy it. But they’ve run out of patience for needing a permission slip to do their job well, and so they find an organization that gives them the authority they need. When they leave, so does their institutional knowledge. Their replacement often starts with even less authority, and the whole cycle resets.
It’s also a security problem. When the people closest to a risk can’t act on it, the fix either waits or finds a workaround. Waiting lets a known vulnerability age past its remediation deadline. Workarounds move approvals outside change management and out of the audit trail. And when the approval finally comes, it often comes from the person with the least context on the risk.
Authority as a control
Here’s the good news: we already know how to handle gaps. We do it for a living.
An undocumented control is a control that doesn’t exist. No auditor would sign off on “Sam just knows who can approve firewall changes.” Yet that’s how a lot of authority works. Spending limits are usually documented, though plenty of people couldn’t tell you where they fall. But strategy input and hiring decisions often aren’t written down at all. They get worked out in hallway conversations, by whoever’s in the room. Over time, informal authority drifts toward people already in the loop and decisions end up lopsided.
So, audit it the way you’d audit anything else:
Establish a baseline. Ask your team, anonymously, whether they have enough authority over strategy, personnel and purchasing decisions. Where the group is large enough to protect anonymity, bring in HR or privacy before you collect gender data, then compare answers across genders.
Write down who decides what. Pick a role and spell out what that person can approve on their own. Then do the same for someone else with the same title. If the answers don’t match and nobody can explain why, you have a finding.
Then tell people. Authority buried in an unread policy changes nothing. Walk each person through what they own, out loud, and put it in writing afterward.
Reconcile the risk register. For every risk with a named owner, check whether that owner can actually approve the fix. Every mismatch is the first paragraph of this article, happening in your organization.
Check the attendance, then change it. If the same people show up to every strategy and budget conversation, that’s your real org chart. Start by bringing the person who owns the risk into the room where it gets funded.
Treat promotions like a change log. If someone moved up a level and their decision rights stayed put, all you shipped was a new email signature. Update both in the same conversation.
None of this requires a special program. When decision rights are written down and shared, authority stops depending on who’s in the loop and the gap women report starts to narrow.
This ISACA data mostly represents good news, with most respondents satisfied at work. Underneath that sit several significant gaps, including a 20-point gap in purchasing authority we’d flag in a heartbeat if it showed up in an assessment.
So, write it up like the finding it is.
Finding: Decision rights are undocumented and unevenly distributed.
Owner: You.
Due: Before ISACA’s next survey.
The full study is available at www.isaca.org/tech-workplace-and-culture.
