The blog
Notes on how organisations really work
Practical articles on assessing and improving maturity, from change management and risk to cloud, security and customer experience.
2026
-
Green IT: Why Keeping Laptops Longer Is Your Biggest Quick Win
Why extending the life of laptops and other devices is one of the most effective green IT actions, and how to do it without frustrating staff or adding risk. -
M&A Integration: Getting the First 100 Days Right
How to plan and lead the first 100 days of a merger or acquisition integration: Day 1 readiness, retaining people, protecting customers and capturing value. -
Ransomware Readiness: 10 Questions Your Leadership Should Answer
Ten questions every leadership team should be able to answer about ransomware readiness, from backups and recovery to decision-making, communication and insurance. -
FinOps Basics: Cutting Cloud Waste Without Slowing Teams Down
A practical introduction to FinOps: making cloud costs visible, sharing accountability with engineers, removing waste and measuring value, without slowing delivery. -
Outcome-Based Roadmaps: Moving Beyond Feature Lists
How to move from feature-and-date roadmaps to outcome-based roadmaps that focus teams on problems, show uncertainty honestly and still satisfy stakeholders. -
Process Mapping Without the Wallpaper
A practical guide to process mapping that leads to improvement, not wall-sized diagrams: setting scope, mapping reality, finding waste and naming owners. -
Is Your Speak-Up Culture Working? How to Tell
How to tell whether people genuinely feel able to raise concerns: the signs to look for, the measures that matter and how to strengthen speak-up culture. -
Structured Interviews: The Simplest Upgrade to Your Hiring
What structured interviews are, why they predict job performance better than informal chats, and how to design questions, scoring guides and interview panels. -
Why CVSS Scores Alone Can't Prioritise Your Vulnerabilities
Why CVSS severity scores are not enough to prioritise vulnerabilities, and how to combine exploitation data, exposure and asset importance into priorities. -
Customer Health Scores That Actually Predict Churn
How to build a customer health score that genuinely predicts churn: choosing signals, weighting them, validating against real outcomes and acting on the results. -
Data Retention Schedules: How to Stop Keeping Everything Forever
How to build a data retention schedule that people follow: deciding how long to keep records, handling legal holds, and making deletion actually happen. -
SLOs and Error Budgets in Plain English
What SLIs, SLOs, SLAs and error budgets are, how they help teams balance reliability with speed, and how to set your first service level objectives. -
Measuring Social Impact: Outputs vs Outcomes
The difference between outputs and outcomes in social impact measurement, how to build a simple theory of change, and practical ways to measure what really changes. -
OKRs vs KPIs: How to Use Both Without Confusing Everyone
The difference between OKRs and KPIs, when to use each, how they work together, and the common mistakes that turn goal-setting into box-ticking. -
Payment Diversion Fraud: The Controls Every Finance Team Needs
How payment diversion and invoice fraud work, the warning signs to watch for, and the practical controls that stop fraudsters changing where your money goes. -
AI Readiness Checklist: 12 Questions Before You Scale AI
Twelve practical questions to ask before scaling AI across your organisation, covering strategy, data, skills, technology, governance and how value is measured. -
Agile Beyond IT: Ways of Working for Non-Software Teams
How marketing, HR, finance, operations and other non-software teams can use agile ways of working: what to borrow, what to adapt and what to avoid. -
Psychosocial Hazards: What Health and Safety Teams Need to Know
What psychosocial hazards are, why regulators now treat them like physical hazards, and how health and safety teams can identify, assess and control them. -
Third-Party Security Questionnaires: Getting Evidence, Not Ticks
How to make vendor security assessments useful: tiering suppliers, asking fewer and better questions, requesting real evidence and monitoring between reviews. -
First Contact Resolution Matters More Than Handling Time
Why first contact resolution is a better guide to service quality than average handling time, how to measure it properly, and practical ways to improve it. -
Double Materiality Explained for Non-Specialists
Double materiality in plain English: impact and financial materiality, how a materiality assessment works, and why it matters beyond reporting rules. -
Comparing Maturity Across Teams Without Starting a Blame Game
How to compare maturity across teams, sites or business units fairly, so differences lead to shared learning rather than league tables and defensiveness. -
Data Governance Without the Bureaucracy
How to introduce data governance that people actually support: start with business problems, name owners, focus on critical data and avoid committees nobody needs. -
Procurement vs Vendor Management: Who Owns What After Signature?
The difference between procurement and vendor management, why relationships fail after the contract is signed, and a simple model for who owns what. -
Questions Every Board Should Ask in an Effectiveness Review
The questions that make a board effectiveness review useful, from composition and information to strategy, challenge, risk and culture, plus how to run it. -
Regulatory Horizon Scanning on a Small Budget
How smaller compliance teams can spot regulatory change early: free sources, a simple monthly routine, impact assessment and getting the right people involved. -
When People Leave, Knowledge Leaves: A Practical Retention Guide
How to stop critical knowledge walking out of the door when people leave or retire: spot the risk early, capture what matters and build habits that keep it. -
Phishing Simulations Done Right: Coaching, Not Punishment
How to run phishing simulations that genuinely reduce risk: realistic design, coaching instead of blame, measuring reporting rates, and avoiding common mistakes. -
WCAG Compliance: Where Most Organisations Fall Short
The most common WCAG accessibility failures, why automated scans miss so much, and the steps that move you from retrofitting to inclusive by default. -
Measuring Employee Wellbeing Without Surveillance
How to measure employee wellbeing in ways people trust: which indicators to use, how to run surveys well, and why monitoring individuals backfires. -
AI Governance for Mid-Sized Organisations: Where to Start
A practical starting point for AI governance in mid-sized organisations: inventory, policy, risk tiers, ownership and oversight, without building a bureaucracy. -
How to Test a Business Continuity Plan Properly
A practical guide to testing a business continuity plan: types of exercise, how to design realistic scenarios, who to involve, and turning results into improvements. -
Change Fatigue: How to Spot It Before It Derails Your Programme
What change fatigue is, the early warning signs to watch for, why it happens, and practical ways leaders can reduce it without slowing down important change. -
DORA Metrics Explained: Measuring Software Delivery Performance
What the DORA metrics are, how to measure deployment frequency, lead time, change failure rate and recovery time, and how to use them without gaming them. -
Maturity Assessment vs Audit: What's the Difference?
How a maturity assessment differs from an audit in purpose, method and output, when to use each, and how the two work together to improve an organisation. -
Key Risk Indicators: Examples and How to Choose Them
What key risk indicators are, how they differ from KPIs, practical KRI examples by risk category, and a simple method for choosing and setting thresholds. -
Writing a Hybrid Work Policy That Actually Works
How to write a hybrid work policy that people follow and that works for the business: what to include, how to decide office days, and common pitfalls to avoid. -
Zero Trust Explained Without the Vendor Hype
What zero trust security actually means, why the old network perimeter no longer works, and the practical steps organisations take to move towards it. -
Why Strategies Fail in Execution, and How to Close the Gap
Why good strategies so often fail to turn into results, the six most common causes of the strategy execution gap, and practical ways to close it. -
Customer Journey Mapping: A Step-by-Step Guide
A practical, step-by-step guide to customer journey mapping: choosing a journey, gathering evidence, mapping stages and pain points, and turning the map into action. -
Why Digital Transformation Programmes Stall, and How to Restart Them
Why so many digital transformation programmes stall after early wins, the five most common causes, and practical ways to get a stalled programme moving again. -
Getting Honest Answers: How to Avoid Bias in Self-Assessments
The common biases that distort maturity self-assessments, from optimism to anchoring, and practical ways to design and run assessments that get honest answers. -
From Lift-and-Shift to Cloud-Native: The Cloud Maturity Journey
The typical cloud maturity journey from lift-and-shift to cloud-native, what changes at each stage, and how to tell where your organisation really stands. -
How to Write a Risk Appetite Statement People Will Actually Use
A practical guide to writing a risk appetite statement that guides real decisions, with a simple structure, worked examples and the mistakes to avoid. -
Why Three Maturity Levels Beat Five
Most maturity models use five levels. Here is why three clearly different levels often give more honest, more useful results in a self-assessment. -
Seven Signs Your Change Management Is Ad Hoc
Seven warning signs that change in your organisation is managed ad hoc rather than deliberately, and the practical first step to fix each one. -
From Scores to Roadmap: Turning a Maturity Assessment Into a Plan
How to turn maturity assessment results into a realistic improvement roadmap: setting targets, choosing priorities, sequencing work and tracking progress. -
How to Run a Maturity Assessment Workshop With Your Team
A step-by-step plan for running a maturity assessment workshop: who to invite, how to collect answers, and how to turn disagreement into agreed priorities. -
The Capability Maturity Model: Where Maturity Models Came From
A short history of the Capability Maturity Model, from 1980s software crises to CMMI, and the lessons that still matter for any maturity assessment today. -
Maturity Model Examples: 15 Areas of Business You Can Assess
Fifteen practical maturity model examples, from change management to cloud and cybersecurity, with what each level looks like and where to start.