Latest Articles

Headline: Change Management Is Having Its Moment — And AI Is the Catalyst That's Making It Work The Change Management Moment Only half of companies have a change management strategy for AI. But that's changing fast. An AWS study found that while only 14% of companies had a change management strategy for AI adoption in 2024, that percentage jumped to 54% in 2025 and is expected to reach 76% by the end of this year . Change management, once seen as an administrative function, is having its moment in the spotlight. The reason is simple: AI is creating rapid, high-stakes shifts that are triggering ripple effects across businesses . Organizations that fail to adapt their change management strategies risk significantly undermining transformation efforts. AI as a Force Multiplier "AI is a force multiplier," said Giulia Sergi, Director of GTM and AI Fluency at Salesforce. "It's already shifting the change manager's role from being really detailed and task-oriented to one where they can think more strategically and proactively" . This is not theoretical. Change managers are using AI to: Analyze Data to Map Strategy: "You can upload tons of data into AI tools and say, 'I want you to create a stakeholder analysis based on this information. Tell me what the biggest gaps and highest impact areas are,'" explains Sergi. "In the past, this process could have taken weeks or months" . Redesign Roles: Stanford's Arvind Karunakaran suggests organizations use AI to map workflows, identify roles, and break roles down into tasks. "Instead of mandating that employees in nontechnical roles learn how to write prompts better, you should figure out the most complex parts of their jobs... and give them the skills they need for those tasks" . Provide 24/7 Support: Salesforce's change management team has trained AI agents on knowledge articles to answer employee questions autonomously. "Now, I don't have to manage or make sure there's a system in place for people to get answers because it's all autonomous and it's 24/7," says Sergi . Why AI Matters for Change Management Traditional change management approaches struggle to keep pace with the speed and complexity of constant evolution. AI helps organizations sense change early and respond in real time rather than relying on static plans . AI also changes how work is designed, not just how tools are used. Without rethinking roles, workflows, and decisions, organizations often limit AI's impact. Using it in change management pushes leaders to reconsider how value is created and how people and machines work together . The Future of Change Management The biggest benefit of AI for change management may be its role as a thinking partner. Sergi uses AI as a brainstorming partner: "I need to be the person that makes the final decisions, but I appreciate having this 24/7 brainstorming partner I can bounce ideas off of and that can share new ways of thinking I otherwise wouldn't have explored" . Organizations that embed AI into how they manage change are better positioned to adapt with purpose and resilience instead of reacting too late . Action Items for Your Organization Assess your current change management strategy for AI adoption Identify where AI can automate routine change management tasks Train change managers on AI capabilities Build AI-powered knowledge bases for employee support Use AI for stakeholder analysis and communication planning

56% of Organizations Use Common Controls Frameworks — Here's Why You Should Too The Audit Fatigue Problem Managing varying global regulations is one of the heaviest operational burdens that modern enterprises face. Replicating work across siloed standards like ISO 27001, NIST CSF, and sector-specific rules creates unsustainable audit fatigue . The manual burden: 76% of GRC professionals still spend 30% or more of their working hours on repetitive, manual administrative tasks . What Is a Common Controls Framework (CCF)? A Common Controls Framework (CCF) rationalizes overlapping standards by mapping a single control to multiple requirements simultaneously. This slashes manual administrative burdens by up to 33% compared to siloed or ad-hoc frameworks . How a CCF Works Without a CCF: Standard Control Evidence ISO 27001 Access Control Evidence A NIST CSF Access Control Evidence B SOC 2 Access Control Evidence C With a CCF: Standard Control Evidence ISO 27001 Access Control Evidence A NIST CSF Access Control Evidence A SOC 2 Access Control Evidence A Key Findings from Hyperproof's 2026 Report 56% of surveyed organizations utilize a common controls framework (CCF) to rationalize overlapping standards . 58% of surveyed organizations now leverage software to continuously monitor controls . Benefits of a Common Controls Framework Benefit Impact Reduced duplication One control satisfies multiple requirements Lower administrative burden Up to 33% reduction in manual work Consistent evidence Same evidence used for multiple audits Faster audits Less time preparing for each audit Better visibility Single view of control status How to Implement a CCF 1. Map Your Requirements List all standards you need to comply with Identify overlapping controls Document control requirements 2. Define Common Controls For each control area, define one control Map it to all applicable standards Document evidence requirements 3. Implement Monitoring Track control status continuously Collect evidence once, use for multiple audits Report on compliance across all standards 4. Maintain and Update Update controls as standards change Add new standards as needed Continuously improve Conclusion A Common Controls Framework (CCF) is the most effective way to beat audit fatigue. By mapping a single control to multiple requirements simultaneously, organizations can slash manual administrative burdens by up to 33% compared to siloed or ad-hoc frameworks . Action Items for Your Organization Map all standards you need to comply with Identify overlapping controls Implement a Common Controls Framework (CCF) Use software to monitor controls continuously Measure the reduction in manual effort  

One AI Agent Isn't Enough — Why Problem Management Requires an Ecosystem of Specialized Agents The Limitations of Single-Agent Systems Single AI agents have significant limitations for problem management: Limited scope (can only analyze certain types of data) Limited perspective (only one analytical approach) Limited learning (changes require human updates) The complexity of IT environments demands a more sophisticated approach. The AI Agent Ecosystem The AI Agent for Proactive Problem Management orchestrates a network of specialized agents, each bringing unique intelligence and capabilities. Together, they create a powerful, coordinated workflow . Perception Agents Role: The system's eyes and ears Capabilities: Continuously scan historical data, events, metrics, and logs Detect recurring issues and hidden patterns Correlate signals across incidents, anomalies, and change requests Build predictive models to anticipate future failures  Reasoning Agents Role: Analytical depth Capabilities: Perform root cause analysis Trace problems back to their origins Generate actionable recommendations Forecast potential issues and suggest preventive measures  Internal Control Agents Role: Accuracy and compliance Capabilities: Validate that identified patterns are reliable Ensure predictions are trustworthy Verify recommended fixes are safe and compliant Safeguard against bias  External Augmentation Agents Role: Human expertise integration Capabilities: Engage domain experts through conversational AI Capture tacit knowledge and intuition Enrich the AI's understanding  Action Agents Role: Translation of insights into action Capabilities: Notify teams about recurring problems Create change requests Trigger ITSM workflows  Learning Agents Role: Adaptation and evolution Capabilities: Continuously learn from changing environments Adapt prediction models Learn from expert interactions  Orchestrated Intelligence These AI Agents work collaboratively within ignio's agentic ecosystem : Real incidents identified by the AI Agent for IT Event Management are transferred to the AI Agent for Incident Management The AI Agent for Proactive Problem Management leverages this intelligence to detect patterns, derive root causes, and prevent recurrence Together, these agents orchestrate seamlessly—perceiving, reasoning, acting, and learning—to transform IT operations from reactive to preventive  Why the Ecosystem Model Works Advantage Explanation Specialization Each agent focuses on what it does best Parallel processing Multiple agents work simultaneously Continuous learning Agents adapt independently Resilience Failure in one agent doesn't break the system Scalability New agents can be added as needed Conclusion The AI agent ecosystem model is the future of problem management. By orchestrating specialized agents that work together—perceiving, reasoning, acting, and learning—organizations can transform problem management from repetitive symptom fixes to scalable elimination of root causes . Action Items for Your Organization Assess your current problem management toolset—is it a single system or an ecosystem? Identify gaps in your current AI capabilities Evaluate agentic AI platforms that offer specialized agents Start with a pilot using a subset of agents Measure the impact of multi-agent orchestration  

Starting from Zero — A Practical Guide to Building a GRC Program That Scales The GRC Journey Building a GRC program from scratch can feel overwhelming. But a structured approach makes it manageable. Phase 1: Foundation (Months 1-3) Assess Current State What is your regulatory environment? What assets need protection? What is your current risk posture? Define Risk Appetite What risks are you willing to accept? What risks must be avoided? What is your risk tolerance? Establish Basic Processes Risk identification Risk assessment Risk treatment Risk monitoring Choose a Framework NIST CSF for cybersecurity ISO 27001 for information security COSO for enterprise risk Phase 2: Implementation (Months 3-9) Build Risk Register Identify risks Assess risks Document in a formal centralized risk register  Implement Controls Select controls Document controls Assign control owners Establish Continuous Monitoring Define Key Risk Indicators (KRIs) Set up monitoring Create alerting Document Processes Risk management process Risk treatment process Risk reporting process Phase 3: Maturity (Months 9-18) Automate GRC Implement GRC platform Automate evidence collection Automate risk assessments Integrate with Other Functions Incident management Change management Third-party risk management Measure Performance Risk metrics Compliance metrics Program effectiveness Phase 4: Optimization (Ongoing) Continuous Improvement Review and update Identify improvement opportunities Implement improvements Proactive Risk Management Predictive analytics Trend analysis Emerging risk identification Common Implementation Challenges Challenge Solution Lack of executive support Build business case; demonstrate ROI Resource constraints Start small; prioritize; use automation Integration complexity Choose integrated platforms; avoid point solutions Resistance to change Communicate benefits; involve stakeholders The Role of Technology GRC platforms automate: Risk assessments Evidence collection Compliance monitoring Reporting Key capabilities: Real-time risk visibility Integrated control mapping Automated evidence collection Continuous monitoring Conclusion Building a GRC program is a journey, not a destination. By following a phased approach and leveraging technology, organizations can build a scalable, effective GRC program. Action Items for Your Organization Assess current state Define risk appetite Choose a framework Build risk register Implement controls Establish monitoring Automate where possible  

The Handoff That Breaks Everything In a relay race, the fastest runners in the world are meaningless if they cannot pass the baton smoothly. The handoff is where races are won or lost. The same principle applies to modern IT service delivery—except most organizations are running a relay where each runner has a different rulebook, speaks a different language, and is actively pointing fingers at the others when the baton drops. Here is the reality facing enterprises today. Organizations have moved decisively from single-provider outsourcing to a "best of breed" multi-supplier landscape . The logic is sound: access specialized expertise, reduce costs, and avoid vendor lock-in. But the result has been an explosion of complexity that traditional ITSM practices were never designed to handle. The consequences are playing out in boardrooms and war rooms everywhere. Disconnected workflows between internal teams and suppliers are causing surges in high-priority incidents . Unrecorded and unauthorized changes are creating configuration drift and system instability . When incidents require coordination across multiple providers, resolution times balloon—and the blame game begins . This is the "Relay Team" problem. And it is the single biggest governance challenge facing IT leaders today. The Anatomy of Multi-Supplier Chaos Problem 1: The "Not Our Fault" Culture One of the most persistent challenges in multi-supplier environments is the "not our fault" attitude, particularly during the early stages of an incident . Suppliers actively reverse the "fix first, argue later" philosophy, pointing fingers elsewhere to protect their own metrics . The result? Major incidents that should be resolved in hours stretch into days. Root cause analysis becomes a blame-storming session. And the customer—your organization—is left holding the bag. Problem 2: The Governance Void Traditional outsourcing contracts are built on bilateral agreements that neglect interdependencies between parties . Each supplier operates with its own processes, standards, frameworks, and tools . The majority of contracts lack cross-provider coordination mechanisms . The consequence is a governance vacuum: Ambiguous responsibilities require additional management attention  Financial disputes arise from incomplete or conflicting contracts  Redundant coordination costs emerge due to unclear service boundaries  Knowledge management is neglected, hindering operational information exchange  Problem 3: The Fragmentation Spiral When several partners manage different modules or functions of a platform like ServiceNow, platform fragmentation becomes a real risk . The absence of standardized practices across regions and vendors leads directly to operational inefficiencies that impact service reliability and user experience . An enterprise case study involving over 55,000 users, 46,000 devices, and nearly 2,800 business applications revealed the scale of the problem . Their challenges included: Inconsistent alignment between the organization and its 11 key suppliers Disconnected workflows leading to high-priority incident surges Manual CMDB updates limiting accuracy and visibility An unstructured service catalog delaying fulfillment and impeding process maturity The SIAM Solution: Governance, Not Just Management This is where Service Integration and Management—SIAM—enters the picture. SIAM is a management methodology specifically designed for multi-supplier environments. It provides governance, management, integration, assurance, and coordination to ensure that the customer organization gets maximum value from its service providers . The Core Concept: The Service Integrator SIAM introduces an explicit integration layer—the service integrator—whose mandate is to make separate providers collaborate, share accountability, and operate as a unified service delivery function . In a SIAM model, providers are not simply managed. They become active ecosystem participants who : Share cross-provider processes for incident, problem, and change management Operate within integrated tooling and reporting structures Participate in collective continual improvement across the ecosystem Work within a defined governance model that assigns clear accountability across organizational boundaries The service integrator acts as an intermediary, maintaining relations between external and internal service providers on behalf of the client . As one practitioner put it, suppliers are no longer concerned with just their own doorstep—but the whole street . SIAM vs. ITIL: Not Competing, Complementary A common point of confusion is whether SIAM replaces ITIL. The answer is a definitive no . Dimension ITIL 5 SIAM Primary focus IT and digital product/service management across an organization Integration and governance of services from multiple providers Core problem solved How to manage IT and digital services effectively How to coordinate multiple suppliers into a coherent, unified service operation Scope Single organization or service management system Multi-supplier ecosystem with a service integrator layer Governance approach Principles applied within a single organization Cross-provider governance with defined accountability Supplier management One practice within a broader framework Central to the entire methodology ITIL 5 tells you what good service management looks like within one organization. It does not address how to integrate and govern services delivered by multiple independent providers simultaneously . That is precisely where SIAM begins. Organizations that build on ITIL with SIAM typically experience : Unified incident and change governance across all providers A shared service language based on ITIL practices Closed accountability gaps that ITIL alone cannot resolve across organizational boundaries Scalable governance that grows with provider complexity SIAM in Action: The Framework The SIAM Ecosystem Layers The SIAM ecosystem operates across four layers : Customer layer: The organization receiving services Service Integrator layer: The mediator responsible for integration and governance Service Provider layer: Internal and external suppliers delivering services Governance layer: The oversight structure connecting all parties The service integrator can be implemented through four structural models : Internal: The client organization retains the integrator role internally External: A third party or lead supplier acts as integrator Hybrid: Shared responsibility between internal and external parties Outsourced: Complete delegation to an external provider The Implementation Roadmap Implementing SIAM follows a structured, phased approach that does not require a "big bang" : Phase 1: Discovery and Strategy Define the vision and objectives of the SIAM initiative Align with the organization's strategic goals Determine the scope of SIAM (which services and providers will be integrated) Phase 2: Assessment Evaluate current ITSM practices and processes Identify all current service providers and their roles Document existing challenges and pain points Phase 3: Design Develop a SIAM framework outlining the integration model Define roles and responsibilities within the SIAM ecosystem Establish the governance structure Map processes, tooling, and RACI matrices per role Phase 4: Implementation Roll out the SIAM model Manage the transition from current operations Launch governance bodies and processes Phase 5: Run and Improve Launch the SIAM model operationally Apply continual improvement Review and adapt based on performance data A best practice is to implement SIAM features in line with expiring outsourcing contracts or tool upgrades, avoiding redundant costs and contractual confusion . Critical Success Factors and Risks Good Practices for SIAM Success Based on real-world implementations, organizations that succeed with SIAM focus on these practices : Governance: Install governance bodies with participants who have appropriate authority and knowledge Process harmonization: Map processes and process roles per participant with clear RACI Unified CMDB: This is the foundation of SIAM success—a badly designed CMDB makes it impossible to assess impact across providers  Contract alignment: Harmonize master service agreements, SLAs, and KPIs across providers Tooling integration: Define a tooling strategy that supports the SIAM journey and avoids platform fragmentation Cultural change: Invest in the people and culture aspects—SIAM brings significant change that is often underestimated  Common Risks to Avoid Implementation challenges are well-documented : Risk Consequence Each provider brings its own process framework and tools Customizations may imply unforecasted costs and ecosystem-wide risk Unified CMDB design lacking agreement Inability to assess impact of changes or incidents across providers Insufficient OLAs between providers Bad collaboration, avoidance of responsibility during incidents SIAM becoming an operational service management layer Added overhead without value, decreasing legitimacy Complex tooling configurations High maintenance during tool and organizational updates Governance participants lacking authority Non-performing governance bodies, ineffective oversight The Business Case: Why SIAM Matters Now Organizations adopting SIAM are reporting measurable results. A global energy leader with 55,000 users implemented a structured SIAM framework to : Strengthen collaboration with key business stakeholders Synchronize workflows between processes and tools Implement predictive monitoring to identify potential high-severity issues early Enrich their CMDB with accurate configuration data Standardize onboarding and offboarding of suppliers across 11 key partners The impact extended beyond operational metrics. Improved data quality, integration, and governance enable future capabilities like AI to work effectively . Research from ISG shows SIAM implementations can deliver : +40% IT productivity +30% compliance with SLAs +20% savings on supplier management Perhaps most importantly, SIAM enables organizations to : Reduce operational risk Avoid vendor lock-in Support agile delivery transformation Maintain strategic and operational control while delegating execution The Future: SIAM and the AI-Ready Ecosystem As organizations prepare for agentic AI in service management, the importance of SIAM becomes even more critical. AI agents are only as effective as the data and processes they can access. In multi-supplier environments, AI readiness requires : Clean, structured data inputs Integrated tooling and reporting structures Clear governance frameworks Consistency across provider operations A ServiceNow Centre of Excellence and Innovation (CoEI) model that governs multi-vendor delivery while maintaining platform consistency is becoming a best practice . The CoEI acts as the control tower, defining architectural standards and enforcing alignment regardless of which vendor executes the work . As one practitioner observed, implementing ITSM with AI is a transformative journey. The successful approach is to build a stable foundation first, then layer in intelligence where it drives efficiency and insight . Conclusion: Are You Running a Relay or a Solo Race? The move to multi-supplier IT is not reversible—and it shouldn't be. The benefits of specialization, cost efficiency, and access to best-of-breed capabilities are too compelling. But the governance challenge is real. If you cannot answer these questions with confidence, you have a relay team problem: Who owns the end-to-end service experience across all suppliers? When an incident requires coordination across providers, what is the escalation path? Do your contracts account for interdependencies between providers? Can you identify the root cause of incidents that span multiple suppliers? Is there a single source of truth for your CMDB across the ecosystem? SIAM provides the framework to answer these questions and transform a fragmented collection of suppliers into a cohesive service delivery ecosystem. The question is not whether you need SIAM. The question is whether your organization is ready to embrace the governance, cultural change, and structured approach that SIAM demands. Because in a multi-supplier world, you are only as fast as your slowest handoff. Call to Action Ready to assess your multi-supplier governance maturity? Start with these three actions: Map your ecosystem: Identify every supplier involved in your IT service delivery Document the handoffs: For your top three services, map where accountability transfers between providers Identify the gaps: Where do handoffs fail? Where does visibility break down? Where does the blame game start? The organizations that master multi-supplier governance will be the ones that scale AI safely, improve operational resilience, and deliver consistently reliable digital services.    

World-class Problem Management Requires Structured Thinking — Here's a Framework That Works The Challenge of Problem Management World-class Problem Management is a strategic advantage. But Problem Managers face significant challenges: Large backlogs Inconsistent data Tribal troubleshooting Limited time with subject matter experts Structured thinking processes provide repeatable, business-aligned approaches to Problem Management trusted globally in high-risk, high-complexity industries. The KEPNERandFOURIE™ Framework The framework includes several key components designed to address different aspects of problem management: PriorityWise Purpose: Problem ticket assessment and action prioritization What it addresses: Which problems to work on first? How to allocate resources effectively? What's the business impact? Process: Assess each problem ticket Score based on impact and urgency Prioritize the most critical problems Allocate resources accordingly CauseWise Purpose: Structured problem definition and cause diagnosis What it addresses: What is the problem? What is the scope? What causes should we investigate? Process: Define the problem clearly Identify what is and isn't affected Develop potential cause hypotheses Test and validate causes Result: Reduction in MTTR by up to 25% RiskWise Purpose: Fix protection and recurrence prevention What it addresses: Will the fix cause new problems? How do we ensure the fix works? What if it fails? Process: Assess risks of proposed fixes Develop mitigation strategies Test fixes thoroughly Monitor for recurrence Why Structured Thinking Works Benefit Explanation Consistency Same approach every time Repeatability Process can be taught and replicated Business alignment Priorities based on business impact Risk management Risks are identified and managed Documentation Every step is captured Key Principles of Structured Problem Management 1. Focus on Business Impact Not all problems are equal. Prioritize based on business impact, not just technical severity. 2. Be Systematic Use the same approach every time. This reduces variability and improves quality. 3. Document Everything Every step should be documented. This enables learning and continuous improvement. 4. Validate Causes Don't assume causes—test them. The scientific method ensures accurate root cause identification. 5. Consider Risks Every fix carries risk. Assess and mitigate risks before implementation. Implementing Structured Thinking 1. Train Your Team Provide training on structured thinking methodologies Practice with real problems Share lessons learned 2. Provide Tools and Templates Problem assessment templates Cause investigation guides Risk assessment checklists 3. Establish Governance Review structured problem management outputs Ensure consistency across teams Continuously improve Conclusion Structured thinking is the hallmark of world-class problem management. By applying proven frameworks like KEPNERandFOURIE™, organizations can reduce MTTR, prevent recurrence, and deliver lasting improvements to service stability. Action Items for Your Organization Assess your current problem management approach—is it structured or ad-hoc? Evaluate structured thinking methodologies for problem management Train your team on structured thinking Provide tools and templates Measure the impact on MTTR and recurrence