Latest Articles

Controls Cost Money — The Question Is Whether They're Worth It The Investment Reality Controls cost money. The question is whether they're worth it. Organizations need to justify controls investment through cost-benefit analysis. The challenge: Regulatory obligations are increasing year-on-year, and enforcement is tougher, which raises the risk and cost of non-compliance . At the same time, organizations face pressure to reduce costs. The Cost-Benefit Analysis Framework Identify Costs Cost Category Examples Implementation Design, configuration, development Operation Personnel, tools, processes Testing Audit, testing resources Maintenance Updates, changes, reviews Identify Benefits Benefit Category Examples Risk reduction Reduced likelihood and impact of incidents Compliance Avoided fines and penalties Efficiency Reduced manual effort, automation Trust Stakeholder confidence, customer trust Competitive advantage Differentiator for customers Calculate ROI ROI = (Benefits - Costs) / Costs The Business Case for Controls Direct Benefits: Benefit Measurement Avoided breach costs Incident frequency × Average cost Avoided fines Regulatory fines avoided Reduced audit costs Manual effort reduction × Hourly cost Efficiency savings Hours saved × Hourly cost Indirect Benefits: Benefit Description Customer trust More likely to win business Stakeholder confidence Board and investor confidence Operational resilience Less downtime and disruption The Cost of Controls Proliferation Excessive controls have costs that may outweigh benefits : Demonstrating effective risk management becomes difficult  Increased risk of non-compliance as controls are misaligned with regulatory expectations  Ineffective assurance and audit fatigue as excessive controls dilute testing capacity  Ineffective and complex change management as it's harder to update and embed controls  Optimization Strategies 1. Eliminate Redundant Controls Eliminate controls that don't add value. Rationalization can slash manual administrative burdens by up to 33% . 2. Automate Manual Controls Automate controls where possible. Organizations can automate over 50% of yearly assessed controls . 3. Implement a Common Controls Framework A CCF rationalizes overlapping standards by mapping a single control to multiple requirements simultaneously . 4. Focus on High-Value Controls Focus resources on controls that address the highest risks and regulatory obligations. Conclusion Controls cost money, but the benefits outweigh the costs when investments are targeted effectively. Organizations that rationalize, automate, and focus controls investment will achieve better returns. Action Items for Your Organization Calculate the cost of your current control environment Identify benefits of controls Calculate ROI for controls Rationalize redundant controls Automate manual controls Focus investment on high-value controls

64% of Buyers Choose Targeted Agentic AI — The GRC Platform Market Is Shifting The Platform Dilemma Organizations face a choice: point solutions or connected platforms. Approach Description Point Solutions Specific tools for specific GRC functions Connected Platforms Unified platforms with integrated capabilities The Market Shift The data suggests a significant shift in buying preferences. Some 64% of respondents said they would rather use targeted agentic AI systems than broad all-in-one platforms. That share rose to 70% among buyers focused on risk . "The horizontal AI platform era in GRC is over, and the data confirms what we're already seeing from the field: buyers aren't waiting for the next generation of tools. They've moved their money toward agents that can prove specific, repeatable, and defensible outcomes" . The Point Solution vs. Connected Platform Debate Point Solutions (Agentic AI) Pros: Focused on specific outcomes Faster time-to-value Lower initial investment Easier to pilot More accountable Connected Platforms Pros: End-to-end visibility Consistent data model Integrated workflows Single source of truth Reduced integration complexity What This Means for GRC Teams For organizations starting out: Agentic AI solutions offer faster time-to-value They focus on specific outcomes They enable iterative improvement For organizations with mature GRC: Connected platforms offer holistic visibility They provide integration across functions They enable enterprise-wide risk management The Hybrid Approach Many organizations are adopting a hybrid approach: Start with targeted agentic AI for specific use cases Integrate these agents into a connected GRC platform Expand as needed Key Evaluation Criteria Criterion Why It Matters Outcomes Does it deliver measurable results? Accountability Who owns the outcomes? Integration Does it integrate with existing tools? Scalability Will it grow with you? Governance Does it support risk governance? Conclusion The GRC platform market is shifting toward targeted agentic AI solutions. Organizations should evaluate both point solutions and connected platforms, choosing the approach that best fits their needs and maturity. Action Items for Your Organization Assess your GRC needs Identify specific use cases for automation Evaluate point solutions Evaluate connected platforms Consider a hybrid approach Choose based on outcomes and accountability

Every Change Is a Learning Opportunity — How to Conduct Effective Post-Implementation Reviews The Purpose of Post-Implementation Reviews Post-implementation reviews are essential for continuous improvement. They should evaluate whether the change achieved its objectives, whether it was executed correctly, and what lessons can be learned for future changes. When to Conduct Reviews Post-implementation reviews should be conducted: After major changes After changes that caused incidents After changes with significant business impact For all change types periodically Timeline: Within 5 business days of change completion Key Questions to Ask Change Objectives: Was the change successful? Did we achieve the expected outcomes? What were the actual results vs. expected? Execution: Was the change executed according to plan? Were there any deviations? What went well? What could have been better? Impact: Were there any incidents? Did we meet the expected timeline? What was the business impact? Learning: What did we learn from this change? What can we do differently next time? How can we apply these lessons broadly? The Post-Implementation Review Template text **Change Summary** - Change ID: [ID] - Date and time: [Date/Time] - Change type: [Standard/Normal/Emergency] - Description: [Brief description]   **Outcomes** - Was change successful? [Yes/No/Partially] - Achieved objectives? [Yes/No/Partially] - Business impact: [Description]   **Execution** - Plan adherence: [Description] - What went well: [Description] - What could have been better: [Description]   **Incidents** - Any incidents caused? [Yes/No] - Severity: [P1/P2/P3/P4] - Root cause: [Description]   **Lessons Learned** - Key lessons: [Description] - Recommendations: [Description]   **Action Items** | # | Action | Owner | Due Date | |---|--------|-------|----------| | 1 | [Action] | [Name] | [Date] | Best Practices 1. Schedule Promptly Schedule the review within 5 business days. Details are fresher, and the change is still top of mind. 2. Include the Right Participants Change initiator Implementation team Impacted stakeholders CAB members (for significant changes) 3. Be Blameless Focus on learning, not blame. The goal is to improve future changes, not assign fault. 4. Document Action Items Every review should result in actionable improvements. 5. Track Follow-Through Ensure action items are completed and improvements are implemented. Conclusion Post-implementation reviews are the engine of continuous improvement. By learning from every change—successful and unsuccessful—organizations can continuously improve their change management practices. Action Items for Your Organization Establish a post-implementation review process Create a review template Schedule reviews promptly Include the right participants Document action items  Track follow-through

The CISO Role Is Evolving — From Oversight to Orchestration of AI-Driven Risk Management The Role Transformation The role of the CISO is evolving from oversight to orchestration. Rather than managing discrete controls and compliance processes, CISOs increasingly oversee AI-driven systems that automate risk management processes across the enterprise . What's Driving the Change 1. Connected GRC Cyber risk no longer exists in isolation. It is deeply interconnected with third-party risk, operational risk, regulatory risk, and enterprise resilience. CISOs are adopting connected GRC platforms that provide holistic visibility across risk domains . 2. AI-First GRC AI is becoming a core capability for CISOs. Predictive intelligence, automated controls testing, and real-time risk insights allow security and risk teams to anticipate threats before they materialize . 3. Regulatory Scrutiny Board expectations, regulatory requirements, and audit standards are elevating the importance of SGR (Security, Governance, and Risk) . The New CISO Responsibilities Risk Orchestration Not just managing controls, but orchestrating AI-driven systems that automate risk management . AI Governance Ensuring AI systems are governed effectively, with clear accountability structures, risk assessments for AI use cases, and controls aligned to emerging regulations . Board Communication Communicating risk in business terms, not technical terms. Demonstrating how risk management supports business objectives. Strategic Partnership Aligning security and risk with business strategy. Showing how risk management enables innovation. Key CISO Takeaways Avasant highlights key takeaways for CISOs : Move from audit readiness to continuous assurance. Leading enterprises are collapsing audit cycles into always-on validation. Prioritize platforms over point solutions. Move away from fragmented point solutions toward unified, AI-enabled GRC platforms. Shift focus from detection to orchestration. The true value of agentic AI lies in autonomous execution—enabling systems not only to identify risks but also to initiate remediation. The Skills Gap Traditional CISO Skills New CISO Skills Technical security Business acumen Incident response Risk orchestration Control management AI governance Compliance Strategic partnership Conclusion The CISO role is evolving from oversight to orchestration. Organizations that prepare their CISOs for this evolution—with new skills, new tools, and new expectations—will be better positioned for effective risk management in the AI era. Action Items for Your Organization Assess your CISO's current role Define the future CISO role Develop new skills (business acumen, AI governance) Adopt connected GRC platforms Support the evolution from oversight to orchestration

Problem Management Delivers 10x ROI — Here's How to Calculate It The Business Case Problem Management reduces : Volume and impact of incidents Rework and repetitive fixes Wasted Subject Matter Expert (SME) time Friction between teams, vendors, and customers Problem Management increases : Service stability Operational confidence Quality of data for leadership decision-making Customer satisfaction and trust Documented ROI Examples Real case example : Benefit Area Impact Number of incidents decreased 4-6% Time for incident solution reduced 95% < 5 days Solver team capacity savings < 5% Reduced severity of incident impact on users < 3% Increase in end-user satisfaction 2-3% ROI Calculation Framework Direct Savings : Savings on solver teams capacity 5% of solver time saved 2,885 man-days saved annually Cost savings: significant Savings on incident solving process Fewer incidents to process Faster resolution Less rework Savings on SLA breach penalties Higher SLA compliance Fewer penalties Indirect Savings : Improved service quality leading to higher employee satisfaction Reduced risk of incidents impacting the business Knowledge reuse Sample ROI Calculation From a ServiceNow ROI model : Item Value Agents on the desk 10 Agent working hours per week 40 Weekly hours available 400 Weekly incident capacity 800 Avoidable incidents through Problem Management 2% Weekly incident saving 16 Yearly cost saving $8,320 Agent saving (FTE) 0.2 Real-World Investment Analysis From a documented case study : Item Value Investment €85,000 Benefits Year 1 €1,205,064 Net Annual Benefits Year 1 €1,188,064 NPV €995,058 IRR 1298% Payback Period 0.08 years Self-Funding Problem Management The FTE saving can be used to either provide a higher capacity on the desk or, and potentially more productively, contribute to the problem management process and drive further savings. In this way, there is a level of self-funding from implementing the process. How to Build Your Business Case Collect current data: Incident volume Incident resolution time SLA performance Support costs Estimate potential savings: What percentage of incidents are recurring? What is the cost of each incident? How much time could be saved? Project investment costs: Tooling Training Ongoing costs Present the business case: ROI calculation Payback period Non-financial benefits Conclusion The economic case for Problem Management is compelling. Organizations that invest in problem management see significant ROI through reduced incidents, improved efficiency, and better service quality. Action Items for Your Organization Collect data on incident costs Estimate potential savings from Problem Management Build a business case for investment Track actual savings after implementation Demonstrate value to leadership

World-class Problem Management Requires Structured Thinking — Here's a Framework That Works The Challenge of Problem Management World-class Problem Management is a strategic advantage. But Problem Managers face significant challenges: Large backlogs Inconsistent data Tribal troubleshooting Limited time with subject matter experts Structured thinking processes provide repeatable, business-aligned approaches to Problem Management trusted globally in high-risk, high-complexity industries. The KEPNERandFOURIE™ Framework The framework includes several key components designed to address different aspects of problem management: PriorityWise Purpose: Problem ticket assessment and action prioritization What it addresses: Which problems to work on first? How to allocate resources effectively? What's the business impact? Process: Assess each problem ticket Score based on impact and urgency Prioritize the most critical problems Allocate resources accordingly CauseWise Purpose: Structured problem definition and cause diagnosis What it addresses: What is the problem? What is the scope? What causes should we investigate? Process: Define the problem clearly Identify what is and isn't affected Develop potential cause hypotheses Test and validate causes Result: Reduction in MTTR by up to 25% RiskWise Purpose: Fix protection and recurrence prevention What it addresses: Will the fix cause new problems? How do we ensure the fix works? What if it fails? Process: Assess risks of proposed fixes Develop mitigation strategies Test fixes thoroughly Monitor for recurrence Why Structured Thinking Works Benefit Explanation Consistency Same approach every time Repeatability Process can be taught and replicated Business alignment Priorities based on business impact Risk management Risks are identified and managed Documentation Every step is captured Key Principles of Structured Problem Management 1. Focus on Business Impact Not all problems are equal. Prioritize based on business impact, not just technical severity. 2. Be Systematic Use the same approach every time. This reduces variability and improves quality. 3. Document Everything Every step should be documented. This enables learning and continuous improvement. 4. Validate Causes Don't assume causes—test them. The scientific method ensures accurate root cause identification. 5. Consider Risks Every fix carries risk. Assess and mitigate risks before implementation. Implementing Structured Thinking 1. Train Your Team Provide training on structured thinking methodologies Practice with real problems Share lessons learned 2. Provide Tools and Templates Problem assessment templates Cause investigation guides Risk assessment checklists 3. Establish Governance Review structured problem management outputs Ensure consistency across teams Continuously improve Conclusion Structured thinking is the hallmark of world-class problem management. By applying proven frameworks like KEPNERandFOURIE™, organizations can reduce MTTR, prevent recurrence, and deliver lasting improvements to service stability. Action Items for Your Organization Assess your current problem management approach—is it structured or ad-hoc? Evaluate structured thinking methodologies for problem management Train your team on structured thinking Provide tools and templates Measure the impact on MTTR and recurrence