Initializing secure session…Initializing secure session…The failure rate of large transformation programs has barely moved in two decades. The reasons are not technical. They are decisions that were never made.
Ask any executive who has lived through a failed transformation what went wrong and you will rarely hear about the technology. You will hear about scope that grew, adoption that never happened, a vendor that over-promised, a cutover that landed in the busiest week of the year, or a program nobody owned once the consultants left. These are not technology failures. They are the consequences of questions that were never asked.
Most programs begin with a technology: a new ERP, a cloud migration, a platform consolidation. Few begin with a precise statement of what the business will be able to do afterwards that it cannot do now. Without that, scope has no boundary and success has no definition. The program becomes a list of features and a date, and both slip.
The organisations that succeed can state the outcome in operational terms — faster order-to-cash, a single view of inventory, a clinician who logs in once — and every decision is measured against it.
If a proposed feature does not move the stated outcome, it is not in scope, however reasonable it sounds. Most failed programs cannot name the outcome and therefore cannot say no.
Every transformation changes someone's daily routine: a nurse, a dispatcher, a sales representative, a plant supervisor. If those people are not involved in the design and prepared for the change, the system goes live and the organisation quietly keeps running the old way alongside it. The new system becomes a costly reporting layer over unchanged work.
Adoption is not a training session before go-live. It is the people who will live with the system shaping it from the start.
Technology is delivered on a date. Transformation is delivered when people stop going around it.
Every organisation has periods and systems where failure is unacceptable: a retailer's peak season, a hospital's clinical systems, a utility's control network, a university's registration week. Transformation programs that do not map those constraints discover them at cutover. Programs that do, sequence the work so the risk lands where the business can absorb it.
This question is also where security belongs. A migration is the moment an organisation's data moves, permissions are rebuilt and vendors gain access. Done without a security design, transformation widens the attack surface. Done with one, it is the best opportunity most organisations ever get to fix what was wrong.
Transformation does not have to be a gamble. It fails for predictable reasons, which means it can succeed for predictable ones. If you are planning a program — or rescuing one — the three questions above are where we start.
This article is general information for business readers, not legal, regulatory, medical or professional advice. Regulations change; confirm requirements for your situation with qualified counsel or your regulator. Imagery is original AI-generated artwork created with Canva. Frameworks and standards named are trademarks of their respective owners.
The difference between an AI program that scales and one that gets shut down after its first incident is rarely the model. It's whether anyone's name is on it.
Read the article →
Zero trust is sold as an architecture overhaul. For most mid-sized organisations it is better understood as a set of decisions about identity, access and assumptions — most of which cost less than the breach they prevent.
Read the article →
Most organisations under a few hundred people do not need a full-time chief information security officer. Many of them badly need the function. Here is how to tell which you are.
Read the article →Start with a free security or AI readiness call — no obligation, and you leave with a clear next step.