The First 90 Days of an Interim CIO at a Credit Union, and How to Prepare Your Successor

The most common way an interim technology engagement fails is not incompetence. It is spending 90 days being briefed.

The pattern is familiar. Weeks one through four are introductions. Weeks five through eight are shadowing. By week nine there is a slide deck describing the current state, and by week 12 the permanent hire arrives and inherits a function that has not moved. Everyone was busy. Nothing was decided.

Avoiding that means running stabilization and assessment at the same time, rather than in sequence. The assessment is what makes the roadmap fundable, and the roadmap is the only artifact that survives the engagement.

That is the playbook for an empty seat. The other common situation is an institution where the seat will not be empty, because someone inside the building is taking it. Coverage is beside the point there. The work is getting the successor ready faster than the calendar would manage on its own, which takes a development runway of six to 12 months and produces a different set of deliverables.

Interim CIO, a mentor for the successor, or an external hire

These are three different engagements, and the choice tends to get made by habit. An institution hires what it hired last time, or what one board member has seen work somewhere else.

The second row is where an institution with a credible internal candidate usually belongs, and it is where the arrangement most often goes thin. The common version is a promotion plus a general executive coach. A coach is genuinely useful for what a coach is for: executive presence, delegation, surviving a peer group that used to be your seniors. A coach cannot tell a first-time CIO whether a core provider's deconversion terms are ordinary for that kind of contract, or whether the remediation written against an examination finding will satisfy the person who wrote the finding. Those are the judgments a newly promoted technology executive is missing, and they are technical judgments.

The arrangement that goes wrong most often is the hybrid nobody plans: an interim holds the seat while the designated successor serves as their deputy for a year. Two people now have partial authority. The organization works out who to ask, and the answer is never the person who will still be there. If the successor can hold the seat with support, put them in it and put the help beside them rather than above them.

The interim, fractional, or firm comparison covers pricing and why the full-time interim market is thin. How we scope either one is on the credit union page.

Days 0 to 30: stabilize

The goal in the first month is that the function stops degrading. Improvement comes later. The decline stops now.

Establish a reporting cadence in week one. A weekly written update to the CEO covering what moved, what is blocked, and what needs a decision. This sounds bureaucratic and it is the most useful thing available, because a departing CIO usually takes the informal reporting relationships with them, and without replacement the CEO is flying blind exactly when they feel most exposed.

Triage in-flight projects into three buckets. Continue, pause, stop. Be willing to use the third. Most institutions in a leadership gap are carrying at least one project that everybody privately knows is not going to work, and which continues because stopping it requires authority nobody currently has. Stopping it in month one buys credibility for everything that follows.

Find the contract renewals inside the next two quarters. This is the most time-sensitive item and the one most often missed. Vendor agreements with auto-renewal clauses do not pause because your CIO left. A renewal that passes unexamined during an interim period locks in another full term, which on a core or digital banking agreement is measured in years. Pull the contract inventory in week one and sort it by notice deadline rather than by expiry date, because the date for avoiding a renewal usually falls months before the renewal itself.

Map the real risk surface, rather than the documented one. Talk to the VPs individually. Every technology organization has two or three people who know precisely what is fragile and have stopped raising it because nothing happened last time. They will tell an interim things they would not tell a permanent hire, because an interim is leaving and has no political stake.

Keep the team. A leadership departure makes good people update their CVs. The retention conversation belongs in the first three weeks, and it is mostly about telling people the truth: what is uncertain, what is not, and when they will know more.

Days 30 to 60: assess the real state

The assessment is a written document. Not a deck. A document, because decks let you skip the parts that are hard to say in a bullet.

What it covers for a credit union or community bank:

• Core platform and integration reality. What actually connects to what, which integrations are supported versus improvised, and where the single points of failure sit.
• Digital banking and member experience. Where the platform is competitive, where it is not, and which gaps members actually notice as opposed to which gaps show up in vendor comparison charts.
• Payments. Cards, ACH, wires, and real-time rails. Whether you are on FedNow or RTP, whether receive-only or send, and what the roadmap assumes about instant payments.
• Data and BI maturity. Almost always the largest gap between what the board believes exists and what exists. Worth being blunt about.
• Security posture and examination readiness. Open findings, their real remediation status, and what the next examination will surface. NCUA's 2026 supervisory priorities center on balance sheet management, payment systems and fraud, and BSA compliance, which is a reasonable outline for what to look at first.
• Team and vendor dependencies. Which functions depend on one person, and which depend on one vendor with no exit path. Both are risks; the second is usually larger and less discussed.

The output should be readable by a board member with no technical background, and should contain at least one thing the organization did not want to hear. An assessment that flatters is not an assessment.

Days 60 to 90: a roadmap the board can fund

Boards do not fund architecture. They fund sequenced risk reduction with named owners, decision points, and costs.

The roadmap needs:

Sequencing with dependencies made explicit. Not a wish list. What must happen before what, and what the consequence of delay is.

Build, buy, or partner calls, with reasoning. For a credit union the answer is usually buy or partner, and the interesting question is which vendor and on what contract terms rather than whether to build.

A hiring plan, including the permanent CIO. Defining the role you are currently filling is part of the job. So is being honest about whether the organization needs the same role it had, which is not always the case.

Costs with confidence levels. "Between $400K and $700K, and here is what determines where in that range it lands" is more credible and more useful than a precise number invented to look decisive.

A first AI and BI governance position. Not a program. A position: what the institution will and will not do, who approves, and what gets inventoried. Examiners are asking, and having a one-page answer beats having a committee.

Eighteen months is roughly the horizon that gets funded. Three-year roadmaps are read as aspiration and deferred. A technically sound plan still gets sent back for reasons that have nothing to do with its technology.

What to refuse in the first 90 days

Being clear about this early prevents the engagement from becoming something else.

Do not run a major vendor selection to completion. You can start one, scope it, and get to a shortlist. Signing a five-year core contract on the recommendation of someone leaving in four months is a governance problem, and a good examiner will say so.

Do not restructure the team. An interim can identify that the structure is wrong. Acting on it belongs to whoever will live with the result.

Do not become the escalation path for daily operations. If production incidents route to the interim, the function has an operational gap that interim leadership will mask rather than fix, and the gap reappears the day they leave.

Do not write production code. If the engagement drifts into delivery, it was scoped as leadership and is being consumed as capacity, and the leadership work is not happening.

What handover actually means

The engagement is judged on what remains afterward. At minimum:

• The written current-state assessment, with a dated revision history
• A vendor and contract inventory with renewal dates and owners
• A risk register that someone internal has agreed to own
• The roadmap, with whatever has already been funded marked as such
• Documented decisions with their reasoning, so the next person can tell what was chosen deliberately and what is accidental

That last one matters more than it sounds. Most organizations cannot distinguish between a decision that was made carefully and one that happened by default. Writing down which is which is a small act that pays out for years.

If an engagement ends and none of this exists, the institution paid for attention rather than for progress.

Making the artifacts the successor's own

A handover pack the successor did not help produce is a library, and nobody defends a library in a board meeting. The mechanics of transferring it are small and slightly awkward:

• The successor writes the next revision of the assessment, and the outgoing interim or advisor edits instead of drafting.
• Risk register entries get owned one at a time, dated, by the person who will answer for them, with acceptance of the residual risk recorded separately because that decision usually needs different authority. A register handed over in bulk is a register nobody owns.
• The roadmap gets presented to the board a second time, by the successor, in their own words, with its author in the room and silent.
• Critical vendors get a call from the successor rather than an email introducing them. Relationship managers remember who called.

The test at the end is one question: can the successor defend any line of the roadmap with its author out of the building? If the answer depends on which line, the handover is not finished.

Developing an internal successor: a 6 to 12 month runway

An internal candidate for a credit union CIO role is usually deep in one area. Infrastructure, or applications, or security operations.

What they have usually not done is present to a board, own an examination response, or negotiate a core contract. Those are the gaps that show up most often, and all three are developable, which is the argument for promoting rather than running an external search. It is also the argument against doing it casually. A successor who is handed the title and left to discover the gap in front of the board loses standing that takes a long time to rebuild.

The first month is a written development plan, agreed by the successor, the sponsor, and whoever is advising. Named gaps, ordered by when they will be needed rather than by how hard they are. The ordering is not a detail. A board meeting arrives on a calendar, an examination arrives on a cycle, and a core renewal arrives whether or not anybody is ready for it.

Board and executive communication

The successor writes the monthly technology report from month one, with the advisor editing rather than authoring. By month three the successor presents it. By month six they take the questions alone, including the question about why something is late.

Most of this is translation. A board assesses risk, sequencing, reversibility, and accountability, and a technically correct plan organized around systems reads to them as a shopping list. The harder skill is presenting a number nobody is certain about without sounding like there is no plan behind it. That is rehearsable, and it should be rehearsed before the board meeting rather than during it.

Examination readiness

The successor takes the open technology findings from month one: what is closed, what is claimed closed, and what an examiner will ask about twice. Findings that belong to other functions stay with those executives, and the successor coordinates the dependencies rather than absorbing them.

Things to walk through before they are needed:

• The last examination report, read start to finish, including the sections about other functions. Examiners cross-reference; successors usually do not.
• The incident clock. Since 1 September 2023, a federally insured credit union has had to notify NCUA as soon as possible and no later than 72 hours after forming a reasonable belief that it has experienced a reportable cyber incident. For qualifying third-party incidents, the clock runs from that belief or from the vendor's notification, whichever comes first, and not every vendor incident crosses the reporting threshold (12 CFR 748.1(c)). Anyone who has never run that clock should run it on paper first.
• Which self-assessment the institution is actually using. FFIEC retired the Cybersecurity Assessment Tool on 31 August 2025. NCUA continues to offer ACET, updated in September 2025 including its NIST references, and using it is voluntary. Assessing the institution's cybersecurity risk somehow is not voluntary, so the successor should be able to name the approach in use and show that it did not lapse when the CAT went away.
• For a state-chartered institution, the state regulator's own cycle and its habits, which are not always the same as NCUA's.

Vendor and core-contract negotiation

The successor should lead one real renewal, with the advisor sitting behind them rather than beside them, and with the walk-away position agreed internally before the first call.

What they need in hand: where the auto-renewal notice window falls, what deconversion and termination fees look like, what the service credits are actually worth in money, what happens to data on exit, and which line items are priced on member count rather than usage.

The structural point is that a credit union is more alone here than it is on most risks. NCUA has no authority to examine the technology service providers its institutions depend on. The temporary authority it held expired at the end of 2001, and GAO has repeated its recommendation that Congress restore it, including in its May 2025 report on AI in financial services. Diligence on a core provider is the institution's own work. Independent assurance reports help, and providers that also serve banks come with examination history, but all of it arrives with a scope that somebody has to read before relying on it.

The guidance around this is moving, though none of it changes who may examine whom. On 11 September 2026, NCUA joined the FDIC, the Federal Reserve, and the OCC in proposing third-party risk management guidance that covers credit unions alongside banks, with comments open for 60 days after Federal Register publication. The three banking agencies issued a separate statement the same day about community banks and their core providers. Both are proposals and neither binds anyone yet, so a successor may well take a renewal to signature before any of it settles. The NCUA guidance an examiner cites today is Evaluating Third Party Relationships, issued in 2007.

Budget ownership

The successor builds the next annual technology budget rather than presenting a slide about it, and defends it to the CFO without the advisor in the room.

The exercise worth forcing is separating what is already committed under contract from what is genuinely discretionary. The committed portion is often larger than the executive team believes, and the discretionary remainder is where every board argument about priorities is actually taking place. A CIO who can say which is which, line by line, stops being the person who asks for money and becomes the person who explains it.

AI strategy and governance

Governance here is an enterprise responsibility, with business owners, risk, compliance, and the board in it. The inventory and the technical judgment still land on the CIO, whether or not the institution has an AI project of its own, because vendor-embedded models arrived before any internal program did. That is where the exposure actually sits, and it is the part most governance programs write last.

What to put in the successor's hands:

• An inventory of where AI is in use, including features switched on inside platforms the institution already licenses. It records uses and systems. No institution can enumerate what is inside a vendor's product, and a plan that assumes otherwise fails its first audit.
• The written position on what the institution will and will not do with AI, and who approves an exception to it.
• An understanding of who asks. Internal audit has a framework for this work in the IIA's Artificial Intelligence Auditing Framework, second edition, issued in September 2024. NCUA's 2026 supervisory priorities do not name AI at all, which does not keep it out of an examination of existing controls. In practice the first hard questions tend to arrive from the board and from internal audit.

The advisor's role has to shrink on a schedule

Months 1 to 3, the advisor is in most of the rooms. Months 4 to 8, they review work the successor has already done. Months 9 to 12, they are on call and the successor decides when to call.

An advisor who attends every meeting becomes the person the room addresses. The successor then holds the title without the authority, and the executive team learns to wait for the second opinion before treating a decision as real. Withdrawal has to be scheduled, announced, and visible, or it does not happen.

The engagement should end against criteria written in month one rather than against a date. Reasonable criteria: the successor has presented to the board twice without help, taken a renewal to signature, answered an examination or audit request end to end, and delivered a budget they can defend line by line.

What the sponsor should expect, month by month

The sponsor is usually the CEO, sometimes with whoever owns succession alongside them. The authority itself comes from whoever appoints and delegates it, and the sponsor is the person best placed to make sure the executive team has heard that it moved.

Two things belong to the sponsor and cannot be handed to the advisor.

The first is announcing the arrangement in plain terms to the executive team and the board: who holds the authority, what the advisor is there for, and when the advisor leaves. Ambiguity gets read as a trial period, and a successor who believes they are on trial does not make decisions.

The second is deciding, in month one, what "not ready" will look like in month 12. This is the uncomfortable one, and skipping it is why these transitions end badly when they do. Without written criteria, month 12 offers two options: confirm someone who is not ready, or remove someone who was told they were the successor. Criteria agreed in advance create a third option, which is extending the runway against a named gap and a date.

There is also a documentation reason to run this deliberately. Since 1 January 2026, the board of a federally insured credit union has been required to maintain a written, board-approved succession plan covering its directors, the management officials its bylaws provide for, and its senior executive officers, plus any other position the board deems critical given the institution's size, complexity, or risk. Whether a CIO sits inside that turns on the responsibilities rather than the title: the senior executive definition runs to assistant chief executive officers, and vice president is one of the examples the regulation gives. For each covered position the plan has to name the position, give the anticipated vacancy date where one is known, say how the vacancy will be filled permanently, and set out the strategy for recruiting candidates with the potential to assume it. The board reviews the plan at least every 24 months and updates it as needed (12 CFR 701.4(e), applied to federally insured state-chartered credit unions by 12 CFR 741.228 except where a state requirement conflicts). A dated development plan for an internal candidate does not satisfy the rule on its own. It is, however, the most concrete form that recruitment strategy can take for the position it covers, and an institution doing the work often has it written nowhere the board can see.

Frequently asked questions

What is the difference between an interim CIO and an advisor to a successor?

Authority. An interim CIO holds the seat and exercises whatever the institution delegates in writing: spending limits, signing authority, the vendor relationships, the board reporting line. An advisor to a successor holds none of that. The successor decides, and the advisor makes sure they are deciding with the information an experienced CIO would have had. The deliverables differ too. An interim leaves an assessment and a roadmap. An advisor leaves a CIO who can run the function.

Is a candidate who has never presented to a board a reason to hire externally?

On its own, no. Board communication is the most developable of the three gaps that usually matter, and an internal candidate starts with two advantages an external hire spends a year acquiring: they know which systems are actually fragile, and the staff already trust them. The harder question is whether the executive team will give a newly promoted colleague the authority to act on what they find, which is a decision about the institution rather than about the candidate.

How long does preparing an internal successor take?

We scope these over six to 12 months, and the calendar drives the length as much as the person does. One full budget cycle, at least one board cycle, and ideally one examination or audit interaction should fall inside the engagement, because those are the hardest things to rehearse convincingly. Where the cycles do not line up, exercises substitute, and what gets assessed is the quality of the decisions rather than attendance.

Can an executive coach do this instead?

For part of it, and a good coach is worth having alongside. The limit is sector experience rather than the job title. Someone who has not run technology inside a regulated institution cannot judge whether a vendor's remediation plan is credible or what a five-year core renewal should cost. Spend on a coach when the gaps are confidence, delegation, and holding a difficult room. Spend on an operator when the gaps are contracts, examinations, and architecture. Plenty of transitions need both, and they are not the same purchase.

Should the advisor attend board meetings?

For the first one or two, yes, and visibly as support. After that it does more harm than good. Directors address whoever they believe is in charge, and an advisor in the room permanently answers that question the wrong way. The better pattern is heavy preparation before the meeting and a debrief afterward.

Who does the advisor report to, and what stays private?

The engagement is contracted with the sponsor, usually the CEO or chief people officer, while the work happens with the successor. Those two facts collide unless the reporting is agreed in writing at the start. Our default is that the sponsor gets progress against the development plan and a straight answer on readiness at agreed checkpoints, while the content of individual working sessions stays with the successor. The exceptions go in the same agreement: material risk to the institution, misconduct, and anything anyone is obliged to disclose goes to the sponsor immediately, and the successor hears that rule before the first session rather than after it. Without the confidentiality, a successor stops raising what they do not know, which is the only thing the arrangement exists to fix.

Does NCUA require a succession plan for the CIO role?

It requires a plan covering directors, the management officials named in the bylaws, and senior executive officers, plus any position the board deems critical given the institution's size, complexity, or risk (12 CFR 701.4(e), effective 1 January 2026, applied to federally insured state-chartered credit unions through 12 CFR 741.228). Whether the CIO role falls inside it depends on the responsibilities rather than the title on the door, and a board treating the CIO as non-critical is making an argument it would have to defend. The plan also has to set out the recruitment strategy for each covered position, which is where a documented internal development plan does double duty.

What happens if the successor is not ready at the end?

That is what the month-one criteria are for. If the gap is specific and closing, extend against a named gap and a date. If it is not closing, the honest answer is an external search, and the successor deserves to hear it from the sponsor before the search starts rather than after. That conversation belongs in month nine. Held until month 13, it costs the institution a year and the successor their standing.

Does any of this work for a community bank?

The structure carries over, and the plumbing differs in ways worth knowing before you reuse anything above. Examination runs through the FDIC, the OCC, or the Federal Reserve, plus the state supervisor for a state charter. The Interagency Guidance on Third-Party Relationships already covers those institutions, as supervisory guidance rather than regulation. The incident exercise changes outright: a banking organization has 36 hours from determining that a notification incident occurred, on a different definition and a different trigger than NCUA's rule, so the 72-hour walkthrough does not transfer. Succession obligations come from the charter and the primary regulator rather than from 12 CFR 701.4. What a first-time CIO is missing looks much the same in both. See technology leadership for community banks.

---

For how we structure these engagements, see technology leadership for credit unions and for community banks. If you are choosing between interim cover, an advisor alongside an internal successor, and an external hire, the interim, fractional, or firm comparison goes deeper on the first. Otherwise, book a call and we will tell you which of the three fits, including when the answer is that you do not need us.