Latest Articles

Risk Appetite Sets the Speed Limit; Risk Tolerance Is the Range at Which Enforcement Happens The Critical Distinction Risk appetite and risk tolerance are frequently confused but serve different purposes : Concept Definition Level Risk Appetite Strategic, board-level decision about how much risk the organization is willing to pursue in achieving its objectives Strategic Risk Tolerance Operational, business-unit-level acceptable variation around that appetite Operational Think of risk appetite as the speed limit and risk tolerance as the range at which enforcement happens . Risk Appetite Definition: The amount of risk an organization is willing to accept in pursuit of its objectives. Characteristics: Board-level decision Strategic Often expressed qualitatively (e.g., "We are risk-averse" or "We are risk-tolerant") Should be documented and approved Examples: "We will not accept risks that could result in material financial loss" "We are willing to accept moderate security risks to accelerate innovation" "We will maintain compliance with all applicable regulations" Risk Tolerance Definition: The acceptable deviation from risk appetite at the operational level. Characteristics: Business-unit-level decision Operational Quantitative thresholds Triggers action when breached Examples: "A breach of risk appetite by more than 20% requires escalation" "Controls must maintain residual risk below 30% of inherent risk" "Any risk exceeding threshold requires executive review" Why Both Are Important Risk Appetite Without Risk Tolerance: No operational guidance Unclear when to act Decisions inconsistent Risk Tolerance Without Risk Appetite: No strategic direction Individual decisions misaligned Risk-taking inconsistent Establishing Risk Appetite and Tolerance Step 1: Define Risk Appetite Board-level discussion Align with business strategy Document clearly Step 2: Translate to Risk Tolerance Business-unit-level thresholds Quantitative where possible Document operational guidance Step 3: Communicate Share with all relevant stakeholders Train on risk appetite and tolerance Integrate into risk decisions Step 4: Monitor Track against thresholds Escalate breaches Review and update Risk Acceptance and Risk Appetite When accepting risks, organizations must ensure : The accepted IT risk should be within the risk appetite The accepted IT risk should not contradict regulations A separate exception should be documented for each unique risk Risk acceptance should be renewed periodically Risk acceptance should be presented and reported to the risk committee Conclusion Risk appetite and tolerance are the foundation of risk decisions. Organizations that define and communicate both will make consistent, aligned risk decisions and avoid surprises. Action Items for Your Organization Document risk appetite Define risk tolerance thresholds Train stakeholders on both concepts Monitor against tolerance thresholds Review and update annually  

The Core Idea: Agentic AI is set to revolutionize ITSM by autonomously resolving incidents, but its success depends entirely on the quality of your data and processes. A majority of organizations are using AI in an environment where processes are fragmented and poorly documented. This blog would explore what "agentic readiness" truly means and offer a practical framework to assess and prepare your operations for autonomous AI. Key Points to Cover: The shift from AI copilots to autonomous agents (handling 75% of Tier-1 requests). The "ITSM maturity gap": 95% use AI, but only 12% have a mature, proactive ITSM approach. Why AI amplifies existing data and process issues instead of fixing them. A practical roadmap for an "ITSM reset": simplifying processes, cleaning data, and strengthening governance before scaling AI. Mention how "ITIL Version 5" is emerging to help formalize AI governance in ITSM. 2. AI Governance and Security: The Unsexy Side of ITSM That Will Make or Break You The Core Idea: With the rise of autonomous AI agents comes a huge risk: if an automated workflow breaks, the "blast radius is bigger than a human mistake". The trend is a move from focusing solely on AI capabilities to prioritizing responsible AI governance, security, and transparency to build trust and stay compliant. Key Points to Cover: The need for governance frameworks (explainable AI, audit trails, kill switches) for agentic AI. That security, data privacy, and integration challenges are now the top obstacles to deploying AI. The increasing importance of "observability" to monitor automated behavior and AI-driven workflows. Regulatory pressures like the EU AI Act are pushing governance to the forefront. 3. Beyond the Ticket: How Proactive ITSM is Redefining IT Service Delivery The Core Idea: IT is moving away from the traditional "break-fix" model. The new goal is to prevent incidents before they happen. This blog would discuss how "degradation" is now a bigger risk than "outages" and how AI-driven observability and predictive analytics are enabling a proactive service model. Key Points to Cover: The end of the ticket-centric model: AI agents handle everyday issues before a ticket is even created. The concept of "observability" vs. traditional monitoring: understanding "why" an issue impacts customers, not just "that" it's down. Moving from reactive firefighting to proactive incident prevention, which can reduce incident volumes by 30-40%. How automated root cause analysis and self-healing are becoming a reality. 4. The "Relay Team" Problem: Mastering Multi-Supplier IT Governance in a Complex World The Core Idea: As IT environments become more complex with multiple SaaS vendors and cloud services, managing all these suppliers as a single, cohesive ecosystem is a major challenge. The "handoff points" between suppliers are where things often fail. This blog would cover the growing importance of SIAM (Service Integration and Management) and multi-supplier IT governance. Key Points to Cover: The "relay team" problem: high-performing suppliers that fail to integrate with each other. Why 82% of organizations want better performance from providers but aren't managing the interfaces between them. The biggest failure point: no one "owns" the service, leading to a lack of accountability and broken processes. A practical, low-barrier entry point: find one service that isn't working and clarify who is responsible for it. 5. The Unexpected Drivers of ITSM: Sustainability, Employee Experience, and ITIL v5 The Core Idea: ITSM is no longer just a technical function; it's a strategic business partner. This blog explores the new drivers shaping strategy: the push for "Green ITSM" (sustainability), the focus on employee experience (EX) to improve customer experience, and the arrival of a new ITIL framework. Key Points to Cover: Sustainability (Green ITSM): How IT asset lifecycle management and data center optimization are key to meeting ESG goals. Employee Experience (EX): How employees expect consumer-grade IT support and how self-service tools are becoming essential for productivity. ITIL Version 5: The new framework addresses how to integrate AI into service management practices. Each of these topics is well-supported by recent industry research and addresses a concrete challenge or opportunity for IT leaders in 2026. You can use these as a base for in-depth articles. give me complete blog The AI-Powered Service Desk: Why Your Data Isn't Ready for Agentic AI Read 12 web pages The AI-Powered Service Desk: Why Your Data Isn't Ready for Agentic AI The AI Paradox in ITSM Today Here is a striking disconnect: 95% of IT professionals are already using AI in their service management operations, yet only 12% describe their ITSM practices as fully mature and proactive . This gap between AI adoption and operational readiness represents one of the most significant risks in enterprise IT today—and it is precisely why your data probably isn't ready for agentic AI. Agentic AI represents the next frontier for IT service desks. Unlike the chatbots and copilot tools that simply suggest answers, agentic AI systems are intelligent and autonomous. They don't just say "Try turning it off and on again"—they can actually reset passwords, grant permissions, triage tickets, and even resolve entire incidents without human intervention . But here is the uncomfortable truth that industry experts are increasingly vocal about: Agentic AI does not fix broken processes; it amplifies them. What Agentic AI Actually Requires At its core, an AI agent is a large language model configured with specific instructions, access to tools, and clearly defined rules for what it can and cannot do . To function reliably, it needs to understand a few fundamental things about your organization: What does "correct" look like in your specific context? What are your resolution patterns and known solutions? What are your categorization and assignment conventions? Where does the handoff to humans occur? What deterministic rules should never be left to AI judgment? The data that grounds these agents comes from your existing artifacts: resolution notes showing how issues were solved, knowledge articles capturing known-good solutions, categorization and assignment patterns, policies, and runbooks . Without these guardrails, an LLM can still attempt to answer—and often answer well—but it may hallucinate a category, fabricate missing details, or propose resolution steps that never existed . The Good News: You Don't Need Perfect Data Here is what has changed dramatically in the shift from traditional machine learning to agentic AI. Under older approaches like Predictive Intelligence, you needed 10,000 to 30,000 labeled records to train a model. That meant long onboarding cycles, manual cleanup, and data readiness becoming a blocker for every new use case . Agentic AI has fundamentally changed this equation. Today's reasoning-based AI can: Reason even with zero examples Infer patterns by reading your knowledge articles and recent incidents Learn from 4-5 related cases, not tens of thousands Generalize across workflows using foundational LLM intelligence  The requirement is no longer "big data." It is "representative guidance"—just enough examples for the AI to understand your norms . What You Actually Need vs. What You Think You Need Data Type Strongly Recommended Nice to Have Not Required to Start Incident records with resolution notes ?     Knowledge articles ?     Assignment groups with descriptions ?     Updated category/subcategory taxonomy ?     CMDB with Configuration Items   ?   Change records with test/backout plans   ?   10,000+ labeled training records     ? The Real Problem: Process Debt and the ITSM Maturity Gap The challenge is not primarily about data volume—it is about process clarity. Research covering more than 1,000 IT professionals shows that AI deployment challenges mirror broader ITSM challenges . The same issues that have made service management difficult for decades are now the obstacles holding back AI: Data privacy and security concerns (23% cite this as the biggest obstacle to deploying AI) Integration challenges (18%) Lack of expertise (14%) Costs (13%)  Academic research has formalized this problem through the concept of "process debt"—the gaps between documented processes and actual practices. A framework developed by researchers at the University of Hawaii reveals that agentic AI readiness requires assessment across five perspectives: activities, decisions, data operations, control flow, and resource management . The uncomfortable truth? Most organizations are deploying AI on top of operational environments that are inconsistent, fragmented, and poorly documented. And AI makes these issues visible very quickly . Why AI Amplifies Problems Instead of Fixing Them Let me give you a concrete example. If your knowledge articles still provide steps to resolve a printer issue on Windows XP, the LLM will dutifully retrieve and present those steps. It doesn't know they are obsolete—it just knows they exist . AI reflects the environment in which it operates. If underlying processes are efficient, AI helps scale that efficiency. If processes are inconsistent, AI makes those inconsistencies more visible and spreads them faster . As one industry expert put it, "Great AI outcomes require strong data and process rigor, and those are two things ITSM orgs have struggled with for 3+ decades. The struggle didn't magically go away because 'We've integrated ChatGPT'" . Becoming AI-Ready: A Practical Framework The organizations getting the most from agentic AI are not the ones deploying it fastest—they are the ones investing in process rigor, clean data, and consistent governance first . Here is a practical approach to becoming AI-ready: 1. Prioritize Your Most Valuable Data Assets Focus on what matters most, not everything. The most critical data for agentic AI is: Incident resolution notes: The goldmine for grounding AI outputs Knowledge articles: Especially for your top queries and incident types Assignment group descriptions: Clear descriptions help the AI understand where to route work Updated incident categories: A clean, current taxonomy prevents AI confusion  2. Document Your Workflows and Decision Points AI is only as effective as the process it supports. Teams that invest time upfront in mapping their workflows consistently see higher accuracy, more reliable automation, and faster time-to-value . A highly effective technique is running workshops around target personas (Service Desk Agent, Change Manager, Network Ops Analyst), mapping end-to-end workflows, identifying inputs, decisions, and outputs, and determining which steps can be offloaded to AI . 3. Start Simple and Scale Gradually Most customers progress naturally through four phases: Crawl: AI Search—letting employees and agents retrieve knowledge conversationally Walk: LLM-powered Virtual Agent—handling inquiries, triage, and simple requests Run: GenAI-Assisted Workflows—drafting incidents, summarizing tickets, recommending solutions Soar: AI Agents—full multi-step automations that classify, diagnose, execute, and close the loop  4. Define What "Good" Looks Like Create clear rubrics for acceptable AI responses. This includes defining: Required fields and data formats Appropriate tone and style Decision logic boundaries When to hand off to humans  The 70% Data Coverage Threshold—And Why It's Not Enough Industry research suggests that 70% data coverage is considered the benchmark required to deploy agentic AI. But this threshold still leaves significant room for hallucination, misinformation, and missed automation opportunities . More data coverage means more of your AI use cases can be implemented and perform at a level that meets expectations. Organizations that invest in improving data quality—conducting data quality audits, reviewing knowledge management, and mapping automation opportunities—are the ones that achieve the 97% coverage necessary for truly reliable AI . Conclusion: The ITSM Reset The year 2026 is shaping up to be the year of the ITSM reset . The next competitive advantage is no longer about whether AI can improve service management—we already have evidence that it can. The question now is whether organizations have the operational maturity to expand those improvements across the enterprise. The organizations that get the greatest value from AI over the next several years will not be the ones that buy the most advanced platform. They will be the ones that clean their data, define ownership, strengthen their governance, and invest in operational excellence before trying to scale AI . You are more ready than you think. Most ITSM organizations dramatically underestimate how prepared they already are for AI. The ones realizing the fastest time-to-value are not the ones with the cleanest data—they are the ones with the clearest workflows and the courage to start small and learn quickly . AI is no longer a destination; it is an operating model. And the sooner your ITSM organization invites AI into its processes—with the right foundation in place—the sooner you will see measurable impact on speed, accuracy, MTTR, and employee experience.    

You Can't Improve What You Don't Measure — Key VRM Metrics Why Metrics Matter Measuring vendor risk management effectiveness helps organizations identify areas for improvement, demonstrate value, make data-driven decisions, and track progress over time. Key VRM Metrics 1. Assessment Coverage Percentage of vendors assessed Percentage of high-risk vendors assessed Assessment completion rates 2. Risk Exposure Number of high-risk vendors Risk score distribution Number of unmitigated risks 3. Vendor Performance SLA compliance rates Incident frequency Resolution times 4. Program Efficiency Time to onboard new vendors Assessment completion time Manual effort reduction 5. Business Impact Breaches from vendor relationships Downtime caused by vendor failures Cost savings from risk mitigation The "Critical Vendor" Trap A common failure mode: teams pour energy into the obvious "critical" vendors while the broader ecosystem remains lightly assessed, inconsistently monitored, and operationally under-controlled . It's that long tail that will eat you much more quickly . The solution: Track coverage across all vendors, not just critical ones. Translating Risk to Business Outcomes Executives don't need more "orange/red/green." They need consequences, options, and tradeoffs expressed in business language . Key metrics for executives: Financial exposure from vendor relationships Expected loss from vendor incidents Mitigation cost and effectiveness ROI of VRM program Reporting Framework Through establishing ongoing monitoring and incident reporting within the TPRM framework, firms can easily outline a clear reporting framework for third party relationships . Reporting elements: Standard metrics that summarize the primary elements of vendor risk portfolios  Information that properly details risks  Reports easily understood by all stakeholders  Conclusion Measuring VRM effectiveness is essential for continuous improvement. Organizations that track the right metrics and use them to drive improvement will reduce vendor risk and demonstrate the value of VRM . Action Items for Your Organization Define key VRM metrics Set up measurement and reporting Establish baseline measurements Review metrics regularly Use data to drive improvement

Headline: A Control Is Only as Strong as the Environment It Operates In The Control Environment Defined The control environment is the foundation of all controls. It encompasses the governance structures, leadership tone, and organizational culture that shape control effectiveness. COSO's Control Environment component is the first and most important component of internal control. The control environment includes: Leadership tone at the top Organizational culture Governance structures Accountability and responsibility Ethical values Competence of personnel Why the Control Environment Matters Controls operate within an environment: A well-designed control will fail in a dysfunctional environment A poorly-designed control can compensate in a strong environment The control environment enables or disables effective controls The reality: In practice, organizational culture and behavior often determine whether controls operate effectively. Many organizations experience a persistent gap between what their GRC platforms report and how their organization behaves under pressure . Elements of a Strong Control Environment 1. Leadership Tone at the Top Leadership sets the tone for controls: Positive Signals Negative Signals Leaders prioritize compliance Leaders prioritize speed over controls Leaders follow controls themselves Leaders override controls Leaders speak about controls Leaders ignore compliance 2. Organizational Culture Culture shapes how controls operate: Control-Conducive Culture Control-Resistant Culture Compliance is valued Compliance is a checkbox People follow controls People bypass controls Controls are seen as enabling Controls are seen as blocking 3. Accountability Clear accountability enables effective controls: Strong Accountability Weak Accountability Control owners identified No clear ownership Performance includes controls Performance ignores controls Exceptions are tracked Exceptions go unnoticed 4. Competence People must have the skills to execute controls effectively: Competent Personnel Incompetent Personnel Trained on controls No training on controls Understand control purpose Don't understand the "why" Can identify issues Can't identify control failures Signs of a Weak Control Environment Incidents recur despite "controls" being in place  Risks emerge unexpectedly  Cultural or coordination failures undermine well-designed controls  Controls are on paper but not in practice Exceptions are not tracked or approved Strengthening the Control Environment 1. Lead by Example Leadership follows controls Leadership speaks about controls Leadership enforces accountability 2. Build a Control Culture Communicate the importance of controls Train on control purpose and value Reward compliance, not just speed 3. Clarify Accountability Clear control ownership Performance management includes controls Clear expectations 4. Enable Competence Training on controls Documentation of procedures Accessible resources Conclusion The control environment is the foundation of all controls. Organizations with a strong control environment—strong tone at the top, control-conducive culture, clear accountability, and competent personnel—will have controls that operate effectively in practice. Action Items for Your Organization Assess your control environment Identify cultural barriers to effective controls Strengthen leadership tone Build a control-conducive culture Clarify accountability Enable competence through training  

Headline: Don't Write Policies That Describe Actions — Write Controls That Produce Outcomes The Design Challenge Many organizations struggle with control design. They create controls that are: Too vague to be operational Too prescriptive to be adaptable Not linked to actual risks Not measurable or testable The result: Controls that exist on paper but don't operate effectively in practice. Design Principles 1. Start with Outcomes, Then Design Controls A common mistake is writing controls that describe actions instead of outcomes . Weak Approach Stronger Approach "Run monthly access reviews" "Access to sensitive systems is reviewed at a defined cadence, exceptions are documented, and results are retained as evidence" Outcomes help you adapt controls to different tools and environments . 2. Translate Requirements to Controls The process of controls management starts with understanding requirements and translating them into controls: Source Example Control Design Regulation GDPR Article 32: Security of processing Implement access controls, encryption, monitoring Standard ISO 27001 A.9.1.2: Access to networks and network services Define access control policy Policy "All sensitive data must be protected" Implement data classification, encryption, access controls 3. Document Technology Dependencies Management determines the dependency and linkage between business processes, automated control activities, and technology general controls . Using risk and control matrices to document technology dependencies helps : Understand which aspects of technology are important to continued operation of controls Identify how various applications and technologies interface with each other Ensure controls are appropriately implemented and monitored 4. Design for Testability Every control should be designed so its effectiveness can be tested : Control Element Testability Consideration What is the control? Can it be clearly described? Who owns it? Is ownership assigned? How is it executed? Is the procedure documented? How is it evidenced? Is evidence generated by operation? How is it tested? Can effectiveness be measured? Control Design Steps Step 1: Identify the Requirement What requirement must be met? Regulatory, contractual, or internal policy. Step 2: Define the Control Objective What outcome should the control achieve? Be specific and measurable. Step 3: Select Control Type Will it be preventive, detective, or corrective? Step 4: Design the Control Activity What specific action will be taken? Who will do it? When will it happen? Step 5: Assign Ownership Who is accountable for the control's operation? Who is responsible for executing it? Step 6: Define Evidence What proof will demonstrate the control is operating effectively? Step 7: Design Testing How will the control be tested? How often? Real-World Example: End-User Spreadsheet Controls Smythe & Smythe International evaluated spreadsheets in its financial close process and identified high-risk spreadsheets based on susceptibility to error and significance to financial statements . They implemented: Input Control: Input data is reconciled to source documentation  Access Control: File-level access is limited to approved users, password required  Version Control: Standard naming conventions ensure only current versions are used  Calculation Testing: Formula changes are tested against manual calculation  Overall Analytics: Analytical business process reviews detect errors  Conclusion Control design is the foundation of effective controls management. Organizations that design controls around outcomes, document technology dependencies, design for testability, and assign ownership will have controls that operate effectively in practice. Action Items for Your Organization Review existing controls for outcome-based design Document technology dependencies for key controls Ensure controls are designed for testability Assign clear ownership for each control Define evidence requirements for each control  

Your Contracts Are Your First Line of Defense — Embed Risk Clauses Before You Need Them The Contract as a Risk Management Tool Contracts are the final and critical piece of vendor risk management . Well-drafted contracts not only facilitate effective cost management but also ensure continuity when unexpected changes occur in the world . Essential Contractual Clauses 1. Data Management and Access Guarantee access to your data in usable formats  Include provisions for real-time backups  Data escrow clause for critical data and applications  Data deletion upon contract termination  2. Service Continuity Transition assistance or unwind clauses  Clear and time-bound exit strategy  Vendor requirement for data migration  Guarantees of data delivery in an open, non-proprietary format  3. Compliance and Transparency Clear assurances and contractual clauses on regulatory compliance  Immediate notification of changes in compliance status  Strong right to audit in all contracts  Complete transparency from the vendor  4. Suspension and Termination Options to pause services or promptly terminate if vendor is sanctioned  Specific and restricted conditions under which vendor can suspend services  Process for service restoration  5. Force Majeure Very strong force majeure clause to include geopolitical aspects  Data access, suspension triggers and emergency continuity clauses  6. Incident Reporting How and when vendors should report security breaches or compliance lapses  Protocols should tie incidents based on their impact on the firm  Roles and responsibilities for remediation and escalations  Geopolitical Considerations When entering new vendor contracts or revisiting older ones, CIOs must start with getting the basics right : Screen vendors and their parent companies for sanctions Evaluate connections with sensitive regions Assess geopolitical exposure of technology partners  Sanctions awareness: A vendor's failure to maintain compliance or their appearance on a sanctions list should trigger a formal review or even a potential contract termination . The "Right to Audit" Clause Strengthen onboarding of new vendor processes to include sanctions, ownership structures and also ensuring strong right to audit in all contracts . What to look for: Right to conduct security assessments Right to review audit and assessment reports  Right to conduct on-site assessments, if required  Adaptive Compliance Clauses Embed compliance obligations within contracts and ensure they are adaptive compliance clauses that automatically update to reflect changes in financial regulation, ensuring continuous compliance without manual contract revisions . Example: A financial services firm could include a clause stating that the vendor must comply with all current and future regulations related to data protection and privacy, as applicable under federal and state laws . Negotiation Leverage In some industries, such as financial services, critical infrastructure and healthcare, regulatory obligations can be used as a negotiation lever . In other organizations, this should be a board-level priority as it potentially impacts business continuity in a material way . Conclusion Contracts are the final and critical piece of vendor risk management . Organizations that embed risk management in vendor contracts—with data access, suspension triggers, and emergency continuity clauses—will cushion the impact of geopolitical and operational risks . Action Items for Your Organization Review all critical vendor contracts Embed data management and access clauses Include compliance and transparency requirements Add suspension and termination provisions Strengthen right to audit clauses Review indemnification clauses