Latest Articles

64% of Buyers Choose Targeted Agentic AI — The GRC Platform Market Is Shifting The Platform Dilemma Organizations face a choice: point solutions or connected platforms. Approach Description Point Solutions Specific tools for specific GRC functions Connected Platforms Unified platforms with integrated capabilities The Market Shift The data suggests a significant shift in buying preferences. Some 64% of respondents said they would rather use targeted agentic AI systems than broad all-in-one platforms. That share rose to 70% among buyers focused on risk . "The horizontal AI platform era in GRC is over, and the data confirms what we're already seeing from the field: buyers aren't waiting for the next generation of tools. They've moved their money toward agents that can prove specific, repeatable, and defensible outcomes" . The Point Solution vs. Connected Platform Debate Point Solutions (Agentic AI) Pros: Focused on specific outcomes Faster time-to-value Lower initial investment Easier to pilot More accountable Connected Platforms Pros: End-to-end visibility Consistent data model Integrated workflows Single source of truth Reduced integration complexity What This Means for GRC Teams For organizations starting out: Agentic AI solutions offer faster time-to-value They focus on specific outcomes They enable iterative improvement For organizations with mature GRC: Connected platforms offer holistic visibility They provide integration across functions They enable enterprise-wide risk management The Hybrid Approach Many organizations are adopting a hybrid approach: Start with targeted agentic AI for specific use cases Integrate these agents into a connected GRC platform Expand as needed Key Evaluation Criteria Criterion Why It Matters Outcomes Does it deliver measurable results? Accountability Who owns the outcomes? Integration Does it integrate with existing tools? Scalability Will it grow with you? Governance Does it support risk governance? Conclusion The GRC platform market is shifting toward targeted agentic AI solutions. Organizations should evaluate both point solutions and connected platforms, choosing the approach that best fits their needs and maturity. Action Items for Your Organization Assess your GRC needs Identify specific use cases for automation Evaluate point solutions Evaluate connected platforms Consider a hybrid approach Choose based on outcomes and accountability

Stop Demanding 15 Fields Up Front — Progressive Disclosure Transforms Service Request Adoption The Form Abandonment Problem One of the most effective catalog design principles is progressive disclosure: ask for only what's needed at submission; gather the rest later if required . When users are confronted with long forms, they either abandon the request or guess at the right options — neither outcome is good. Why Progressive Disclosure Works The Problem with Collecting Everything Upfront Users get frustrated and abandon: A form with 15 mandatory fields feels like a burden, not a help Users guess, leading to misrouted requests: When fields aren't clear, users guess — and get it wrong Support teams spend time correcting, not fulfilling: Every incorrect field must be fixed before work begins The Progressive Disclosure Solution Traditional Approach Progressive Disclosure 15 mandatory fields upfront 3-5 essential fields upfront Technical jargon users don't understand Plain language, clear labels One-size-fits-all fields Conditional fields based on previous answers Information gathered before it's needed Additional information gathered during fulfillment How Progressive Disclosure Works in Practice Example 1: Hardware Request Traditional form: Full name Employee ID Department Cost center Manager approval Hardware type Brand preference Model preference Memory specification Storage specification Screen size preference Operating system preference Delivery address Delivery date preference Progressive disclosure approach: What do you need? (laptop, desktop, monitor, accessory) Who is this for? (myself, new hire, replacement) Any special requirements? (brief description) Additional details — specifications, delivery preferences — are gathered during fulfillment, not at submission. Example 2: Software Request Progressive disclosure flow: Select the software from a searchable list (3 fields) Who needs it? (user lookup) — one field appears based on software selection Why is it needed? (business justification) — appears only if required The "Three-Question Rule" A practical rule of thumb: limit your intake form to three questions on the first screen. Additional information should be conditional or gathered later. The Three Questions: What do you need? (select from a clear list) Who needs it? (user lookup) Why is it needed? (brief justification) Benefits of Progressive Disclosure Benefit Description Higher completion rates Users are more likely to finish a short form Fewer abandoned requests Less friction means more adoption Better data quality Users provide accurate information when it's clear what's needed Faster fulfillment Fewer corrections needed Better user experience Forms feel helpful, not burdensome Conclusion Progressive disclosure transforms service request forms from a barrier to a gateway. By asking for only what's needed upfront and gathering the rest during fulfillment, organizations can dramatically improve adoption, accuracy, and user satisfaction. Action Items for Your Organization Review your most complex request forms — how many fields? Identify which fields are truly needed at submission Move optional fields to conditional questions or fulfillment Test with real users — observe where they get stuck Measure completion rates and abandonment  

The Equation Has Changed For decades, the measure of IT success was simple. Did the service work? Was it available? Organizations chased uptime percentages and ticket closure times as proxies for value delivery. The formula was Utility + Warranty = Value . In 2026, that equation is no longer sufficient. You can have 99.9% uptime and still fail . The emerging consensus across industry research, framework updates, and practitioner experience points to a fundamental shift: value in ITSM now demands three additional dimensions. The new equation reads: Value = Utility + Warranty + Experience + Sustainability . If your applications work but make users cry (Experience) or burn a rainforest (Sustainability), you are not creating value anymore . This shift is being codified in the industry's most influential framework, driven by employee expectations, and demanded by regulators and boards alike. ITIL v5: The Framework That Read the Room Just as organizations were settling into ITIL 4, PeopleCert announced the next evolution: ITIL v5. Reactions ranged from "cash grab" to "the update we actually needed" . A balanced assessment suggests the truth lies somewhere in between—but with meaningful changes that ITSM leaders cannot ignore. The Identity Shift: From ITSM to DPSM The most significant change is a rebranding of the discipline itself. ITIL 4 was about IT Service Management (ITSM). ITIL v5 repositions the focus to Digital Product and Service Management (DPSM) . This is not semantic gymnastics. ITIL 5 acknowledges what organizations have been struggling with for years: we no longer simply "manage" services; we build digital products, and the gap between "Product" teams (who build and break things) and "Service" teams (who keep them running) has been a persistent source of friction . By unifying product and service lifecycles, ITIL 5 provides a framework to bridge this gap. The goal is to stop the "Build Trap"—shipping features nobody actually wants because product and service teams operate in silos . The framework explicitly strengthens the link between strategy, product management, delivery, and operations, aligning with product operating models and continuous delivery . From Planning to Discovery ITIL 4 had a value chain activity called "Plan." It assumed we knew what we were doing. ITIL v5 replaces this with "Discover"—acknowledging that in complex digital ecosystems, certainty is an illusion and learning is a capability . This shift reflects a fundamental change in mindset: organizations cannot plan their way to success in environments characterized by rapid technological change and evolving user expectations. They must discover needs, experiment, and adapt before committing resources . AI Governance Built In, Not Bolted On Perhaps the most anticipated addition to ITIL v5 is the explicit treatment of AI and automation governance. Unlike previous versions where AI considerations were implicit or added later, ITIL v5 provides a practical framework for AI-native service management . The framework introduces the "6C Model" for AI: Creation, Curation, Clarification, Cognition, Communication, and Coordination . This is designed to help organizations use AI to clean up messy knowledge bases or summarize 50-page incident logs without pretending robots are taking over jobs tomorrow . More importantly, ITIL v5 emphasizes that AI should be treated as a teammate, not a magic wand. It calls for clear human accountability in AI-driven processes, acknowledging that if you design systems without clear human accountability, you eventually lose the ability to stop them when they are "confidently wrong" . A key principle emerging from the framework is: AI doesn't fix bad data, unclear ownership, or inconsistent processes. It scales them—quickly, confidently, and repeatedly . Organizations barely ready for automation should let AI recommend, not decide; assist, not replace; explain, not obscure . Sustainability: From Nice-to-Have to Core Practice The integration of sustainability into ITIL v5 is not just rhetorical. The framework introduces mandatory measurement of energy consumption for every digital transaction . This represents a fundamental shift from sustainability as a corporate social responsibility initiative to sustainability as an operational imperative. Green ITSM: What It Actually Means Green IT Service Management (Green ITSM) has evolved from academic concept to operational necessity. Research has established that Green ITSM can deliver competitive advantage over traditional ITSM frameworks . Organizations that integrate sustainability principles across ITSM processes can achieve reduced resource consumption, increased regulatory compliance, and improved social acceptance . The practical applications span the entire service lifecycle : ITIL Phase Green ITSM Application Service Strategy Financial incentives for green decisions; green service catalogs; demand management for sustainability Service Design Green service levels; "Follow the Moon" service provision for energy efficiency Service Transition Reuse or recycling of decommissioned configuration items; green change advisory boards Service Operation Power consumption analysis; data center temperature management; virtual helpdesk systems Continual Improvement Green service portfolios; Deming cycle for sustainability options The Business Case for Green ITSM The business case for Green ITSM extends beyond compliance. Organizations are discovering that sustainability initiatives: Reduce costs through energy optimization and resource efficiency Enhance reputation with environmentally conscious stakeholders Attract talent as younger generations prioritize sustainability in employment decisions  Create competitive advantage by differentiating in an increasingly crowded market  With ITIL v5 introducing sustainability as a core practice, organizations that delay Green ITSM integration risk falling behind competitors who treat sustainability as a strategic imperative rather than a compliance checkbox . Employee Experience: The New ITSM Cornerstone The second major driver reshaping ITSM is the elevation of Employee Experience (EX) to a "transformational" priority. According to Gartner's 2025 Hype Cycle for ITSM, digital employee experience (DEX) tools are expected to reach mainstream adoption within two years . From SLAs to XLAs This represents a fundamental shift from traditional service-level management toward experiential measures. Organizations are beginning to assess IT performance less on mechanistic measures like ticket closure times and more on its ability to enhance employee performance and satisfaction . The focus is moving from Service Level Agreements (SLAs) to Experience Level Agreements (XLAs)—measuring what employees actually feel rather than what metrics show . This is a recognition that an application can meet every technical SLA and still fail the experience test if it's frustrating to use. The Data Challenge: Subjective Tickets One of the key barriers to improving employee experience is the challenge of subjective tickets. When an employee submits a ticket that says "My PC is slow," traditional ITSM tools lack the context needed to troubleshoot effectively . The solution lies in real-time experience data. Modern ITSM platforms can integrate endpoint data to provide complete visibility into the employee's experience: device compliance, reboot history, abnormal performance, and new software installations . With this context, service desk agents can reduce the time spent contacting employees for additional details and accelerate resolution. Proactive Experience Management Beyond solving reported issues, employee experience data enables proactive identification of unreported problems. For every reported issue, there are hundreds—if not thousands—that go unreported . Real-time insights allow organizations to: Understand not just one employee's frustrations but the frustrations of an entire workforce Identify patterns across all impacted devices Apply fixes across every impacted user, not just those who complained Prevent hundreds of tickets from ever being created This shift from reactive to proactive support is central to the employee experience transformation. Instead of solving one ticket, organizations can prevent hundreds from happening in the first place—and improve the experience of countless employees without ever interacting with them . The Convergence: ITIL v5 as the Unifying Framework What makes the current moment significant is the convergence of these three drivers—sustainability, employee experience, and AI governance—within a unified framework. The New Value Equation ITIL v5 codifies the expanded definition of value that practitioners have been moving toward for years : Dimension Traditional Focus ITIL v5 Focus Utility Does it work? Does it work AND create positive outcomes? Warranty Is it available? Is it available AND resilient? Experience Not measured Customer and employee experience as first-class design drivers Sustainability Not measured Mandatory measurement of environmental impact Decision Maturity Over Process Maturity An important perspective emerging from the ITIL v5 conversation is that the framework is less about process maturity and more about decision maturity . Organizations that will get the most value from ITIL v5 will not be asking "How do we implement this?" but rather: "Who owns value end to end?" "How do we make tradeoffs explicit?" "How do we scale responsibly without losing trust?"  This is a much more executive-level conversation—one that positions ITSM as a core business capability rather than a support function . The Governance Imperative A critical insight from industry practitioners is that ITIL v5 describes responsibilities, roles, and practices but does not enforce decisions . The framework is governance that is descriptive, not executable. The challenge for organizations is to translate ITIL v5 principles into enforceable accountability, especially as AI agents gain decision-making authority. The framework reminds us of four simple truths : Humans still own decisions Intelligent Automation comes before Artificial Intelligence Governance exists to protect good judgement, not suffocate it ITIL v5 is a reference model, not a replacement for thinking What This Means for Your Organization The convergence of sustainability, employee experience, and ITIL v5 creates both challenges and opportunities for ITSM leaders. Immediate Actions Audit your value measurement: Does your definition of value include experience and sustainability? If not, your metrics are outdated. Assess your employee experience data: Can you proactively identify issues before users report them? Do you have real-time visibility into employee experiences? Map your sustainability practices: Where are you already implementing Green ITSM? Where are the gaps that ITIL v5 will expose? Build AI governance before AI deployment: Establish clear accountability structures for AI decisions before letting AI make decisions. Bridge product and service teams: Use ITIL v5's DPSM framework to create shared ownership of outcomes between product and service teams. Key Questions for Leadership Does your organization measure sustainability impact for digital services? Can you demonstrate the employee experience impact of your IT investments? Is your AI governance built on a foundation of clean data and clear accountability? Are your product and service teams aligned around shared outcomes? Conclusion: The Maturity Jump ITIL v5 has been described as "less of a rewrite and more of a maturity jump" . The same could be said of the broader trends reshaping ITSM. Sustainability and employee experience are not radical departures from previous thinking—they are recognitions that the existing value equation no longer captures what matters. Organizations that treat ITIL v5 as a static framework will struggle. Those that use it as a thinking model for digital value creation will move ahead . The convergence of sustainability, employee experience, and AI governance within a unified framework represents an opportunity to reset ITSM for a new era. The organizations that lead in this new era will be those that recognize ITSM is no longer just an IT discipline—it is a core business capability . They will treat frameworks as reference models, not replacements for thinking. They will invest in data and governance before AI. And they will measure success not by uptime, but by the experience they create and the sustainability they enable. The ITSM reset is here. The question is whether your organization is ready to embrace it. Call to Action Ready to assess your readiness for the new ITSM triad? Start with these three questions: Can your current metrics demonstrate the employee experience impact of your services? Do you have a sustainability measurement framework for your digital operations? Is your AI governance built into your processes, or bolted on after the fact? Organizations that answer these questions honestly—and act on the answers—will be best positioned for the future of ITSM.  

Quality Is Not an Accident — A Guide to Quality Assurance and Improvement The Quality Imperative Standard 12.1 requires the CAE to develop and conduct internal assessments of the internal audit function's conformance with the Global Internal Audit Standards and progress towards performance objectives . Standard 12.2 requires the CAE to develop objectives to evaluate the internal audit function's performance . Standard 12.3 requires the CAE to establish and implement methodologies for engagement supervision, quality assurance, and the development of competencies . The Quality Assurance Framework 1. Internal Quality Assessments Post-Engagement Reviews: Review of workpapers for compliance with policies and procedures  Evaluation of adherence to methodologies Identification of improvement opportunities Annual Self-Assessment: Annual internal self-assessment of compliance with professional standards  Review of performance against objectives Identification of improvement areas 2. External Quality Assessments Periodic External Validation: Periodic self-assessment with independent external validation of compliance with professional standards (every 5 years)  External perspective on quality Benchmarking against peers 3. Performance Measurement Standard 12.2 requires the CAE to develop objectives to evaluate the internal audit function's performance . Key performance indicators: Audit plan completion rate Stakeholder satisfaction Finding implementation rate Audit report timeliness Budget adherence Quality Assessment Example The Rochester Institute of Technology's IACA provides examples of conformance : IACA has implemented a comprehensive quality assurance program which consists of: Internal post-engagement review of workpapers for compliance with IACA policies and procedures Annual internal self-assessment of compliance with professional standards Periodic self-assessment with independent external validation of compliance with professional standards (every 5 years) Methodologies and Quality The CAE must establish methodologies to guide the internal audit function in a systematic and disciplined manner . These methodologies must be evaluated and updated as necessary to improve the internal audit function and respond to significant changes . Conclusion Quality assurance is essential for audit effectiveness. Organizations that implement comprehensive QAIP programs will achieve higher-quality audits and stronger stakeholder confidence. Action Items for Your Organization Implement a QAIP program Conduct post-engagement reviews Perform annual self-assessments Arrange periodic external validations Define performance objectives Review and update methodologies

Every Change Is a Learning Opportunity — How to Conduct Effective Post-Implementation Reviews The Purpose of Post-Implementation Reviews Post-implementation reviews are essential for continuous improvement. They should evaluate whether the change achieved its objectives, whether it was executed correctly, and what lessons can be learned for future changes. When to Conduct Reviews Post-implementation reviews should be conducted: After major changes After changes that caused incidents After changes with significant business impact For all change types periodically Timeline: Within 5 business days of change completion Key Questions to Ask Change Objectives: Was the change successful? Did we achieve the expected outcomes? What were the actual results vs. expected? Execution: Was the change executed according to plan? Were there any deviations? What went well? What could have been better? Impact: Were there any incidents? Did we meet the expected timeline? What was the business impact? Learning: What did we learn from this change? What can we do differently next time? How can we apply these lessons broadly? The Post-Implementation Review Template text **Change Summary** - Change ID: [ID] - Date and time: [Date/Time] - Change type: [Standard/Normal/Emergency] - Description: [Brief description]   **Outcomes** - Was change successful? [Yes/No/Partially] - Achieved objectives? [Yes/No/Partially] - Business impact: [Description]   **Execution** - Plan adherence: [Description] - What went well: [Description] - What could have been better: [Description]   **Incidents** - Any incidents caused? [Yes/No] - Severity: [P1/P2/P3/P4] - Root cause: [Description]   **Lessons Learned** - Key lessons: [Description] - Recommendations: [Description]   **Action Items** | # | Action | Owner | Due Date | |---|--------|-------|----------| | 1 | [Action] | [Name] | [Date] | Best Practices 1. Schedule Promptly Schedule the review within 5 business days. Details are fresher, and the change is still top of mind. 2. Include the Right Participants Change initiator Implementation team Impacted stakeholders CAB members (for significant changes) 3. Be Blameless Focus on learning, not blame. The goal is to improve future changes, not assign fault. 4. Document Action Items Every review should result in actionable improvements. 5. Track Follow-Through Ensure action items are completed and improvements are implemented. Conclusion Post-implementation reviews are the engine of continuous improvement. By learning from every change—successful and unsuccessful—organizations can continuously improve their change management practices. Action Items for Your Organization Establish a post-implementation review process Create a review template Schedule reviews promptly Include the right participants Document action items  Track follow-through

Your AI Agent Is Only as Smart as Your CMDB — Why Configuration Data Is the Foundation of Intelligent Incident Management The CMDB's Forgotten Importance The Configuration Management Database (CMDB) has been a foundational element of ITSM for decades. But as organizations focus on AI and automation, the CMDB is often neglected. This neglect has consequences. Without trusted operational data: AI agents cannot make safe decisions Automated remediation becomes risky Root cause analysis becomes unreliable Detection accuracy deteriorates Operational resilience weakens The rise of AI is making foundational Service Management more important—not less. Why CMDB Quality Matters for AI AI Agents Need Context When an AI agent tries to resolve an incident, it needs to understand: What configuration items are involved? What dependencies exist between them? What's the impact of a change? What's the service history? The CMDB provides all of this context. Without an accurate CMDB, AI agents are operating in the dark. Automated Remediation Needs Trust When AI agents auto-remediate, they need to trust the data they're acting on. If the CMDB is inaccurate, auto-remediation becomes risky. CMDB Quality Automated Remediation Accurate AI can safely execute remediation Inaccurate AI may make things worse Incomplete AI may miss dependencies Outdated AI may act on obsolete data Root Cause Analysis Relies on CMDB Data When AI agents analyze incidents, they need to understand the service landscape. Without CMDB data, root cause analysis is incomplete. The CMDB Quality Problem Common CMDB Issues Issue Impact Incomplete data Missing configuration items Inaccurate data Wrong relationships, attributes Outdated data Changed systems not reflected Duplicate data Conflicting information Poorly defined relationships Incomplete dependency mapping The Impact of Poor CMDB Quality Impact Description AI cannot make safe decisions Without trusted data, AI can't act Automated remediation fails Risks outweigh benefits Root cause analysis incomplete Missing dependencies Incident routing broken Wrong assignment groups Business impact unclear Unclear which services affected Building a CMDB for AI 1. Define the Data Model What configuration items matter? What attributes are needed? What relationships are important? 2. Populate the CMDB Discover existing CIs Import from authoritative sources Manually add where needed 3. Ensure Data Quality Validate against authoritative sources Remove duplicates Correct errors 4. Maintain the CMDB Regular discovery Change management integration Quality monitoring 5. Integrate with AI Provide AI access to CMDB data Ensure AI can query CMDB Use CMDB data in AI decisions The Relationship Between CMDB and AI Incident Management CMDB Quality AI Incident Management Capability Excellent Full AI automation Good AI-assisted incident management Fair Limited AI capabilities Poor AI not feasible Conclusion: The CMDB Foundation The CMDB is not obsolete. In fact, it's more important than ever. As organizations deploy AI for incident management, the CMDB provides the trusted operational data AI agents need to make safe decisions. Your AI agent is only as smart as your CMDB. Action Items for Your Organization Assess CMDB quality: Understand completeness, accuracy, and currency Prioritize CMDB improvements: Focus on critical services Implement discovery: Automate CMDB population Integrate with change management: Keep CMDB current Make CMDB data available to AI: Enable AI to use CMDB data