Change Management Risk Assessments

🇪🇺 CBOM: The New Compliance Imperative by 2026 While most organizations manage a Software Bill of Materials (SBOM), a Cryptographic Bill of Materials (CBOM) remains largely overlooked. Yet, EU regulations are rapidly converging to make cryptographic inventory a mandatory requirement. ||| WHY THIS MATTERS NOW The EU's Cyber Resilience Act (CRA) and NIS2 Directive, alongside the EU PQC Roadmap, are creating a clear mandate for cryptographic transparency. By the end of 2026, understanding and managing your cryptographic assets will no longer be optional, shifting from a niche concern to a core compliance pillar. || WHY SHOULD YOU CARE ↳ Avoid significant non-compliance penalties and market access restrictions under new EU regulations. ↳ Mitigate critical vulnerabilities arising from unmanaged or outdated cryptographic implementations, especially with the advent of post-quantum cryptography. ↳ Prepare for operational overhauls in product development, supply chain management, and incident response requiring new tools and expertise. || ACTIONABLE STEPS ↳ Conduct a comprehensive audit of all cryptographic components within your products and systems. ↳ Develop a robust CBOM generation and management strategy, integrating it into your existing compliance frameworks. ↳ Invest in training and tools to ensure your teams can effectively identify, track, and update cryptographic assets. | RELEVANT STANDARDS AND REGULATIONS This shift is directly driven by the Cyber Resilience Act (CRA), NIS2 Directive, and the EU PQC Roadmap, making cryptographic inventory a critical component of cybersecurity compliance. If you build, certify, or sell connected products in Europe, cryptographic inventory is your new baseline for security and compliance. ♻️ Share this with your product development, security, and compliance teams. P.S. What are the biggest challenges you foresee in implementing a comprehensive CBOM strategy?

Changing a company’s name might seem like a simple paperwork exercise, but for B9 Beverages (makers of Bira 91), it turned into a costly lesson—₹80 crore lost in revenue. The company removed "Private" from its name, transitioning from B9 Beverages Private Ltd to B9 Beverages Ltd. 👉This minor tweak triggered a legal and regulatory domino effect. 👉Re-registering labels and licenses across states took 4-6 months, leading to a period where Bira 91 had demand but no supply. 👉 To make things worse, Delhi NCR and Andhra Pradesh—two key markets—underwent major policy changes, further disrupting sales. While Bira 91 was caught up in red tape, other brands could have filled the gap. In an industry where shelf space and brand visibility matter, losing months of availability meant losing customers to rival brands. Key Takeaways for Businesses: 👉 Regulations Can Make or Break You: Industries like alcohol, pharmaceuticals, and financial services operate under strict compliance laws. Even the smallest legal changes can trigger massive operational disruptions. Always consult regulatory experts before making structural shifts. 👉 Brand Strength Isn’t Enough—Distribution Matters: Even though Bira 91 is a well-known brand, its absence on shelves created opportunities for competitors. In FMCG and alcohol, availability is key. If your product is missing for months, consumers switch loyalties. 👉 Every Small Decision Has a Big Business Impact: A name change might seem like just a formality, but in reality, it impacts licensing, sales, supply chains, and brand positioning. Leaders need to evaluate the financial and operational risks of every decision, no matter how small. #startup #business

We are automating decisions we haven’t fully defined. That’s the risk hiding in plain sight. Before automation, humans absorbed ambiguity. Context. Judgment. Nuance. AI doesn’t absorb gaps. It locks them in. If a decision isn’t clearly defined, AI will still execute it. At scale. With confidence. Healthcare learned this the hard way. When criteria are vague, automation doesn’t clarify them. It hardens them. Memorable line: If you can’t explain a decision, you shouldn’t automate it. AI doesn’t remove ambiguity. It forces it to choose. The leadership question is simple and uncomfortable. Do we actually agree on how this decision should be made? If the answer is no, automation will decide for you. Best practices before automating decisions: Define decision boundaries in plain language Document assumptions and failure modes Separate judgment from execution Require human review where stakes are high Refuse to automate what cannot be explained AI doesn’t just execute decisions. It exposes the ones we never fully understood. Organizations that recognize this early will avoid scaling the wrong logic. Harvey Castro, MD, MBA. #drgpt Follow me and repost #AI #ArtificialIntelligence #Leadership #ResponsibleAI #AIGovernance #DecisionMaking #DigitalTransformation #RiskManagement #HumanCenteredAI #DrGPT

Is your workforce prepared for the monumental shifts coming by 2030? The skills gap isn't just a buzzword; it's a looming challenge that demands our immediate attention if we want to build a future-ready industry. Consider these insights that underscore the urgency: - SAE International warns that roughly one-third of all engineering roles will remain unfilled through at least 2030 due to a lack of qualified talent. That's a significant hurdle for innovation and progress. - The World Economic Forum highlights that 54% of the advanced manufacturing workforce will need reskilling or upskilling by the same year to meet evolving demands. We're talking about a massive transformation. I spent some intentional time this week considering my own team’s skills and the capabilities we need over the next few years to drive workforce transformation across our ecosystem. We need focus on empowering individuals and building a workforce capable of truly driving digital transformation. That's where recognized and verifiable credentials step in as a critical solution, helping to "mind the gap" that we've discussed before. Not all credentials are created equal. Both employers and students are increasingly looking for concrete proof of quality and industry relevance, especially for the skills vital for our evolving industrial landscape. - Recent Accredible research shows a striking 94% of HR and talent leaders want credentials with third-party endorsements – yet only 31% of issuers currently provide them. There's a clear demand for trust. - Coursera's findings echo this, with 61% of students prioritizing accreditation and quality assurance when choosing microcredentials. They want to know their investment in learning will pay off. Across Siemens, we map technological and business trends against core competencies to developing new education content to drive innovation. At Siemens Digital Industries Software, we’ve launched the first ABET-recognized industry credential that is gaining traction in both the existing workforce as well as in academia to address digital skillset gaps. ABET recognition isn't just a badge of honor - it's a testament to our commitment to quality and our passion for empowering engineers. It ensures that individuals gain the truly verifiable, high-standard skills essential to expedite their careers and lead digital transformation. How are you ensuring your team is equipped for 2030 and beyond? Let's discuss how we can collectively build the workforce of tomorrow. (Photo below taken this week of the beginning of a 252-step stairway in Galena, Illinois, to inspire our journey forward. Onward and upward to new capabilities and new heights!)

Construction's $1B risk allocation problem. That NOBODY wants to address: When clients provide site data with "use at your own risk" disclaimers, they're not eliminating risk - just creating a ticking time bomb. The Australian Constructors Association and Consult Australia have joined forces to tackle this issue through their "Partnership for Change" initiative: What reliance information includes: - Geotechnical reports - Concept/reference designs - Utilities data - As-built drawings - Contamination reports - Condition of existing assets The impossible position for tenderers: → Cannot verify during tight tender periods → Have no contractual relationship with the original advisors → Must accept "all risk" clauses or be disqualified → Receive zero relief when information proves inaccurate The partnership recommends 2 approaches: PREFERRED APPROACH: - Client secures third-party reliance from original advisors - Original consultants allow reliance for project delivery - No expectation of 100% accuracy, but a mechanism for collaboration when issues arise - Clear risk allocation based on ability to control FALLBACK POSITION: - Re-investigation of reliance information - Early Contractor Involvement (ECI) to assess data collaboratively - Provisional sums with extension of time provisions - Baseline reports that quantify specific risk thresholds Proof these approaches work: Level Crossing Removal Project's alliance model delivered dramatic improvements: - Competitive bid: 5% estimate omissions vs Alliance: 0.9% - Competitive bid: 6.6% cost overrun vs Alliance: 2.2% underrun - 88 weeks tender time reduced to 38 weeks Snowy 2.0 Pumped Storage Project implemented a geotechnical baseline report (GBR) that: - Set out clear risk allocation between client and tenderer - Created a principled sharing of complex geological risks - Prevented tenderers from assuming unknowable risks - Established reasonable expectations for all parties As the partnership paper states: "It is incorrect to assume that because a risk is deemed to have been transferred that it no longer exists." Risk transfer isn't risk management. It's risk multiplication. Has your organisation implemented any of these collaborative risk approaches? What were the results? 

He said, “Everyone in the boardroom agreed my logic was flawless — it made perfect sense. Yet the decision may still follow a path chosen long before the meeting even began.” He looked at me, confused and a little shaken: “Why do organizations do that?” --------------- This disconnect is rarely about logic—it’s usually about psychological, social, and organizational pressures that outweigh rational reasoning. Here are the key psychological drivers: 1. Cognitive Dissonance: “Changing course means I was wrong.” Corporate Example: A manager has invested weeks in a plan. Your new logic makes their plan look flawed. Admitting your argument means admitting their earlier decision was suboptimal. 2. Status-Quo Bias: “Better stick to what we already decided.” Corporate Example: Teams prefer predictable outcomes (even mediocre) over uncertain but logical alternatives. 3. Loss Aversion: “What if your idea causes trouble?” Corporate Example: A change in strategy might mean redoing work, upsetting stakeholders, or risking political capital. 4. Social Conformity & Group Dynamics: “Let’s not rock the boat.” Corporate Example: If a senior leader favors one direction, others will align—even if they say your logic “makes sense.” 5. Fear of Losing Face: “I can’t be seen changing my mind.” Corporate Example: Managers may worry that changing their stance makes them appear inconsistent or weak. 6. Ego Defense Mechanisms: “I’m protecting my identity.” Corporate Example: A leader who sees themselves as “the expert” may resist ideas from someone junior, not because of the content but because of the identity threat. 7. Sunk-Cost Fallacy: “We’ve already invested too much.” Corporate Example: Months of work or alignment meetings make it psychologically painful to pivot. 8. Hierarchical Pressures: “What will my boss think?” Corporate Example: Even if your idea is better, it may conflict with what a senior leader previously endorsed. 9. Internal Politics: “What’s logical isn’t necessarily what’s strategic.” Corporate Example: A team might reject a rational idea because it shifts power to another department. 10. Emotional Comfort Over Rational Clarity: “I don’t feel safe changing direction.” Corporate Example: Your idea may be right—but it may trigger anxiety, ambiguity, or perceived risk. --------------- To apply these insights, ask yourself: 1. Which psychological forces do you think were at play in your situation? (Ego? Politics? Conformity?) 2. What might the group have been trying to protect? (Their status, identity, or prior decisions?) 3. If the barrier was emotional, not logical—how might that change your approach? 4. What influence strategy might work better ? (e.g., building alliances before presenting , framing as “their idea,” or aligning with incentives) ----------------------------- These are few insights about human psychology. A better understanding may help you to navigate organizational complexities. What do you say?

Nothing More than Feelings (Intention is not equal to Action) One of the quiet assumptions in organizational change work is that if people feel the right things, the right behaviors will follow. If employees feel engaged, trusted, psychologically safe, and aligned, they will speak up, experiment, and contribute in ways that move the change forward. It’s an appealing idea. It’s also unreliable. Think about New Year's Resolutions, people vowing to go to the gym every January. Intentions do not always lead to action. If they do, will they be sustained? Most change initiatives stall not because employees oppose them, but because behavior does not shift in ways that matter operationally. People may genuinely support the change and still choose silence over candor, caution over experimentation, and compliance over contribution. The problem is not attitude. It is risk. And the effort required. Speaking up, challenging existing practices, or trying something untested carries social cost. Employees weigh the possibility of embarrassment, loss of face, reputational damage, or being seen as a troublemaker. Because humans overweight potential losses relative to potential gains, these social risks loom larger than the abstract benefit of helping the organization. This is especially true in hierarchical settings, where power distance magnifies the perceived penalty of getting it wrong. As a result, belief in psychological safety can coexist with very little actual voice. This is why organizational change cannot rely on intentions, endorsement, or emotional commitment alone. Feelings shape motivation, but they do not remove ambiguity. They do not neutralize loss aversion. They do not tell people how or when to act. What changes behavior is design. Structured routines that make speaking up expected rather than heroic. Sanctioned experiments make trying something new legitimate rather than risky. Clear permissions, boundaries, and scripts that turn discretionary courage into normal work. When leaders design the architecture of change—its rituals, defaults, and decision rules—they reduce uncertainty and social risk. Voice becomes routine. Experimentation becomes legitimate. Action stops depending on individual bravery and starts depending on collective design. The real test of organizational change is not whether people feel aligned. It’s whether the system reliably produces different behavior, even when people are cautious, or uncertain. Or even simply tired. #ESAmentor #OrganizationalChange #Behavior #PermissionedAgility

Land of the Disengaged? Or just unheard?   Employee engagement in #Germany has hit an all-time low. According to the Gallup Engagement Index 2024, the number of highly engaged employees has dropped to single digits—while 78% are emotionally uninvested, doing just enough to get by.   Even more striking: • 50% don’t see themselves with their employer in a year • Only 34% plan to stay for at least three years   This isn’t just a leadership issue—it’s a communications one. Because in times of uncertainty, people don’t just need direction. They need connection.   Too often, we try to prevent disengagement instead of actively building motivation and belonging. But what’s the cost of that passivity? A culture where people feel unseen, unheard, and ultimately, uncommitted.   As internal communicators and leaders, we can’t afford to let silence fill the gaps. What makes the biggest difference?   ✅ Communicate openly—even when the message is tough ✅ Create consistent touchpoints that invite dialogue, not just updates ✅ Show people their feedback matters—then act on it ✅ Celebrate wins, recognize contributions, and make purpose visible   Engagement isn’t just about retention. It’s about trust, meaning, and making people feel they’re part of something worth showing up for.   Especially now, leadership and internal comms must work hand in hand. It’s time to step up. #engagement #connection #deloitte Deloitte

𝘛𝘩𝘦 𝘴𝘬𝘪𝘭𝘭𝘴 𝘨𝘢𝘱 𝘪𝘴 𝘢 𝘱𝘦𝘳𝘴𝘪𝘴𝘵𝘦𝘯𝘵 𝘢𝘯𝘥 𝘨𝘳𝘰𝘸𝘪𝘯𝘨 𝘤𝘩𝘢𝘭𝘭𝘦𝘯𝘨𝘦. While demand for talent remains high, the hiring rate has fallen sharply, and a shocking number of job openings remain unfilled even as the number of unemployed people is steadily rising. One major reason for these developments is a growing disconnect between the skills employers need and those job seekers have. To meet this challenge, we need to rethink how we approach talent development. Reskilling and upskilling are a necessity. Businesses can’t wait for the perfect candidate with the perfect skill set to show up—they need to invest in developing the skills of the workers they already have. How? There’s mentorship, training programs, and leveraging technology like AI. All these can ensure workers are equipped with the skills we need today and in the future. But it’s not just about developing one’s in-house talent. Employers must also be open to diversifying their approach to attracting external talent, including identifying and engaging with untapped talent pools—people who might not have followed traditional career paths but have the skills to thrive in the right environment. In an era characterized by rapid technological change, employers must take a proactive, forward-looking approach to investing in talent, offering the right opportunities for growth, and developing skills that align with tomorrow’s needs. Only through these efforts can we close the skills gap and build a future-ready workforce.

Struggling with Skills Gaps? It's Time to Transform Your Strategy. According to EY, nearly two-thirds (62%) of companies are struggling to fully leverage AI due to gaps between technology and talent. This challenge spans industries, threatening to leave many organizations behind. Companies face two key types of skills gaps: scaling up existing capabilities and sourcing entirely new ones. For instance, while many businesses have machine learning engineers, few possess the advanced skills required to implement retrieval-augmented generation (RAG) systems or knowledge graphs. So, how can you close these critical gaps? Here are four strategies to get started: 1️⃣ . Upskill Your Workforce for Future Needs It’s not just about addressing today’s gaps but also preparing your team for future roles and skills while making your organization agile enough to pivot through future disruptions. Investing in skills like prompt engineering, AI model integration, and collaborating with AI agents will be essential for long-term success. 2️⃣ . Leverage AI to Boost Efficiency and Job Satisfaction AI tools like Copilot can improve coding speed by 55%, freeing developers to focus on more complex, fulfilling work. This helps alleviate skill shortages while boosting employee satisfaction by automating repetitive tasks and fostering meaningful engagement. 3️⃣ . Close Gaps in Data and Infrastructure Whether you develop in-house capabilities or partner with external AI providers, preparing proprietary data and sourcing the right infrastructure is crucial for effective AI integration. Addressing these foundational elements is key to long-term AI success. 4️⃣ . Build Buy-In by Addressing Employee Concerns AI adoption isn’t just about tech—it’s about people. One of the biggest challenges is earning employee buy-in. Leaders need to emphasize that AI isn’t here to take jobs, but to empower employees. Refactoring roles to collaborate with AI and creating new, AI-enhanced positions provide growth opportunities and help retain top talent. ⏳ The time to act is now. AI is reshaping tasks and roles, and businesses that fail to address these gaps risk being left behind. By upskilling your workforce, modernizing your infrastructure, and fostering a culture of acceptance, you can bridge the talent and technology gaps and unlock the full potential of AI. If this resonates with you, let’s connect. I’d love to hear where you are in your AI journey and explore how I can help. #futureofwork #digitaltransformation #aiandhumans #skillsgap