The State of Digital Transformation It is easy to be sympathetic with those developing digital technologies that are frustrated with the relatively slow adoption of digital transformation. By analogy, the internet has significantly changed the way we think and operate our businesses along with our own personal lives. The internet continues to this day to be the foundation for new and exciting possibilities, including further digital transformation. It is no wonder that many are anxious to quickly move ahead and wonder why companies are only taking incremental steps. One of the reasons for this is that companies are inherently resistant to change. This is partly due to the resiliency needed to continually create products and services their customers enjoy. This resilience manifests itself in many ways that include: processes that produce consistent output, management systems that ensure quality, programs that drive down risk to keep employees and the environment safe, and competent workers that are trained to use the latest standards and best practices. Often these are developed over years and become part of the company culture. These "structures" contribute to reliably make the products and services we depend on every day. Most of us don't think twice when we turn the light switch and discover that the light in the room actually turns on and that it does this almost every time. This "resistance to change" comes in sharp contrast to the disruptive posture often used to promote digital transformation. There is often an appeal to evolution that argues that change is inevitable and therefore companies should adopt digital transformation or be left behind as did the proverbial dodo bird. This is understandable, but perhaps misguided, if only for the reason that we know that evolutionary change (in the Darwinian sense) results from chance not by design or intent. Asking companies to change, however, does require intent and that demands an appeal of a different sort. Companies need a reason to change and for that they need at least an answer to the question, "how will digital transformation help my company achieve its goals?" The promise of digital transformation Before we can consider possible answers to this question, we first need to understand what digital transformation is. At a very high level it can be framed in the following way: Digitization – the transformation of analog information into digital form Digitalization – is the process of the technological-induced change brought about by digitization (ex. Internet of Things, blockchain, cryptocurrencies, Industry 4.0, etc.) Digital Transformation – the total and overall societal effect of digitalization The impact of digital transformation is often presented in terms of improved productivity. However, after you consider the cost of undergoing a transformation, it is not clear that productivity improvements, particularity incremental ones, are enough. Companies already have significant investments in technologies that remain mostly unexploited that could be used to improve productivity. Why this doesn't happen is a topic that will be discussed later in this blog. However, the primary motivation for pursuing digital transformation is not really about improved productivity, although that may happen. It is instead more about creating new ways of doing things that result in different processes altogether. Transformations of this kind are less certain in terms of what they might be, and the nature and extent of the impacts. We only need to look at companies like: Facebook, Twitter, Google, Amazon, Uber, as well as others to get an appreciation for this. Predicting with any measure of certainty that that these specific companies would emerge along with their specific impacts is something best left to speculation. What should companies do? So what do you do if you are a company that is involved in producing, let's say, physical things rather than purely digital products and services, for example, an oil producer. CEOs for these kinds of companies are correct to question how digital transformation can help them at all. Companies have many other concerns that need to addressed such as: increasing costs, threats resulting from cyber-attacks, increased regulations, and keeping their employees, communities, and the environment safe, to name only a few. Many CEOs may read about the "Internet of Things" and wonder how this might help their company. They already have sensors and control systems that monitor operations and collect lots of data all on their own secure networks. Perhaps, data could be made more useful by organizing it better. However, the thought of connecting all your sensors to the internet seems like it would add more risk rather than reduce it. Consideration of other digital technologies such as: block-chain, cryptocurrencies, machine to machine communications and others may also leave companies wondering how these would help: maintain adequate margins, keep people and the environment safe, or generally reduce the level of risk in operating their business. It is hard not to conclude that digital transformation might just be a set of technologies looking for a problem to solve, and these problems are not your problems. This is how it it was when such things as: personal computers, the internet, and cell phones, where first introduced. We knew that change was coming but it was not clear exactly what that change would be. The best you could hope for is that when the time came you would have the time necessary to adapt. How to get ready? A good question that companies might ask themselves is, "what capabilities do I need to have so that I am ready to make the change when the time came?" It may not be possible to know what specific skills you will need. However, it is possible to develop the skills and culture to adapt to changes more quickly and in a safe manner so as to increase the certainty that you will have the time you need to adapt to a new way of doing things. One might even argue that those that are already doing continuous improvement are in a stronger position to adapt to digital transformation or any other changes for that matter. These companies already have a culture that accepts change more easily and that might be the most important thing. Another capability worth considering is the ability to understand how to transform business processes to new ways of doing work. This is a skill that in many ways reached its pinnacle following the first introduction of computing. During that time we learned all about business modeling, re-engineering, and the like. This was when the role of the business analyst was essential to transforming business processes to adapt to MRP and later ERP, CRM, CMMS, and other enterprise management systems. You were a business analyst because you new the business and you understood technology and that combination is rare today. In fact, with the continued outsourcing of IT, this role has been eliminated in many companies. A jobs-to-be-done example I recently spoke with a company looking for a solution to a problem they were having with generating calibration protocols for customized laboratory equipment to be used by field technicians. This problem involved integration with existing data and documentation. This was a jobs-to-be-done (JTBD) example in an enterprise context and clearly a candidate for digital transformation. However, no one in their company understood the business or the problem well enough to form adequate requirements and evaluate possible solutions. In fact, the only person who best understood how to go forward was the director of marketing who was given the task because the source of the problem was a customer complaint. This was compounded by the lack of expertise, they discovered in the marketplace, to build enterprise solutions and who understood their business processes. This was in a part of the United States that has the most high-tech companies than any other, probably in the world. However, most of them, while skilled in the latest agile, programming languages, and cloud-based architectures where heads-down trying to become the next digital technology unicorn ($1Billion valuation) and had little interest in enterprise JTBD problems using technologies they consider to be old and obsolete. This is not a unique situation, although, it hard to know how wide-spread this issue is. However, it does appear that digital transformation is not really directed to help existing companies and is more about developing the next Facebook or Uber. Preventative measures Many companies have significant challenges and problems that need to addressed. They also have (for the most part) substantial untapped capabilities buried in their existing enterprise platforms that remain to be exploited. These may not be "emerging technologies" but they are definitely not obsolete either. The argument that companies need to tear down existing technologies and infrastructures in favor of the promise of something new and shiny should be considered cautiously. Change no matter how beneficial the outcome comes at a cost that needs to be accounted for. The diminishing of capabilities primarily in business analyst roles may have come at the expense of excessive cost reduction strategies brought about by the aggressive outsourcing of IT along with re-platforming to the cloud. It may be time for companies to bring back the role of the business analyst to help transform business processes to tackle the jobs-to-be-done right now and to help transform business processes when digital transformation strategies are more mature. Combining the role of business analyst with a continuous improvement culture is a powerful combination to prepare for change, planned or disruptive.

With the increases in the number and severity of security breaches, digital factories could benefit from risk-based process safety management to protect against unexpected releases of private data, information, and insights. Process Safety is a combination of engineering and management skills focused on preventing catastrophic accidents, particularly explosions, fires, and toxic releases, associated with the use of chemicals and petroleum products. Process safety practices have evolved over decades of experience and many lessons learned. Process Safety is focused on the identification of hazards and their effective removal and or mitigation. Safety barriers (i.e. risk controls) are put in place to guard against unexpected releases and are designed into the process and then maintained for the life of the facility. A Management of Change (MOC) process is used to preserve the design of the facility along with existing safety barriers. Either one can be modified provided that risk is managed. In the case of an incident an emergency response system is used to minimize consequences and to restore safe operations.

Digital twins are virtual counterparts of physical entities that merge real-time data from sensors and IoT devices with sophisticated analytics and simulation, facilitating monitoring, analysis, and optimization of operations and assets. Digital Twin Safety Alongside benefits of Digital Twins, the integration of Artificial Intelligence (AI) introduces additional considerations and risks commensurate with how digital twins are used either as a Digital Shadow, Decision Support, or for Autonomous Control: Digital Shadow: Digital twins provide real-time representations of physical entities, offering insights without direct interaction. AI algorithms enhance the analysis of data within digital twins, but they also introduce the risk of bias or errors if not carefully trained and validated. Moreover, AI-driven decisions may be opaque, making it challenging to understand their rationale and assess their reliability. Decision Support: Digital twins can serve as decision support tools by providing actionable intelligence through advanced analytics and simulation. AI algorithms within digital twins enable predictive modeling and optimization, but they may also amplify errors or biases present in the data. Additionally, complex AI models may lack interpretability, hindering decision-makers' ability to trust and understand their recommendations. Autonomous Control: Digital twins in its most advanced state enable autonomous control by acting on decision-making based on real-time data and predictive insights. AI algorithms drive autonomous actions within digital twins, enhancing efficiency and responsiveness. However, they also introduce risks of malfunction or adversarial attacks, potentially leading to unintended consequences or safety hazards. Additionally, AI-driven autonomous systems may face ethical considerations regarding accountability and transparency in decision-making. While the integration of AI enhances the capabilities of digital twins, it also introduces considerations related to algorithmic bias, interpretability, and system reliability. Addressing these considerations requires rigorous validation, transparency, and ethical oversight to ensure the responsible and effective use of AI within digital twin technologies across diverse applications and industries. Digital Twin Safety In light of the risks associated with digital twins, particularly when integrating Artificial Intelligence, establishing robust safety programs is imperative to protect the public and effectively contend with potential risks. A comprehensive Digital Twin Safety Program should encompass rigorous risk assessment, validation, and continuous monitoring mechanisms. This involves identifying and evaluating potential risks arising from data inaccuracies, algorithmic biases, cybersecurity threats, and system malfunctions. Additionally, the safety program should prioritize transparency and accountability in decision-making processes, ensuring that stakeholders understand the basis of AI-driven actions and can intervene if necessary. Regular audits and evaluations of digital twin systems are essential to identify emerging risks and adapt mitigation strategies accordingly. In addition, collaboration between industry stakeholders, regulatory bodies, and technology developers is crucial to establish standards, guidelines, and best practices for the responsible deployment of digital twin technologies that use machine intelligence capabilities. By implementing robust safety programs, organizations can mitigate risks, safeguard public welfare, and foster trust in the use of digital twins across various domains.

Many of you may be familiar with the concept of digital twins in futuristic factories, but what if I told you your business is already building one, right now? The truth is, every company, from the corner bakery to the global conglomerate, is accumulating a powerful – and often unrecognized – tool: its digital twin. Imagine this: a vast collection of data – customer interactions, sales figures, website clicks. Valuable information, certainly, but without context, it's akin to a disorganized warehouse. This is where the current landscape is changing. In today's hyper-instrumented world, every click, transaction, and interaction is captured, generating a mountain of data. Yet, without proper organization, it becomes overwhelming and unusable. That's where meta data steps in. This isn't about your customers; it's about your internal operations – the processes, systems, and the flow of information that make your business tick. Think of it as the labelling system for your digital world, creating the opportunity for real-time intelligence as well as compliance. By meticulously building a robust foundation of meta data, you're essentially creating a digital replica of your business – a digital twin. This unseen partner unlocks a game-changer for compliance: real-time assurance. The digital twin serves as your "golden thread" of compliance. It's a continuously updated digital record that tracks evidence, your commitments (regulations!), and ultimately, your obligations. Imagine a clear audit trail readily available at your fingertips. No more waiting for audits to find out that you are off-side and at risk. But the power goes beyond simple record keeping. The digital twin empowers a proactive approach to compliance. It acts as a virtual model, allowing you to identify potential issues before they snowball into problems. This translates to improving the probability of staying between the lines and ahead of risk. The big idea? Just collecting data is no longer enough. At Lean Compliance, we understand the importance of context and connections. By harnessing the power of meta data and your hidden digital twin, you're not just organizing your data; you're building a powerful compliance ally, ready to navigate the ever-changing regulatory landscape with confidence. This is the future of compliance – real-time, proactive, and driven by the insights hidden within your own business.

When Prediction Becomes the Plan AI agents are being built to act on the predictions of AI models. That should give us pause. The belief behind this is simple. The model predicts the future, and the agent acts on that prediction as if it were reality. When an agent acts on a prediction, it helps make that prediction real. Its actions shape what happens next. The future arrives looking the way the model said it would. The model appears to have been right, and we trust it a little more the next time. Over time, the prediction and the plan become the same thing. Predictive policing shows how this works. A model predicts crime in a neighbourhood. More patrols are sent there. More incidents are recorded. The model looks accurate, and the next prediction points to the same place. This is the trap of the self-fulfilling prophecy. Models are useful. They may see patterns we miss. Yet every model is wrong in some way, because a model is a simplification of reality. Even when it reads the trend correctly, the future is still open. It is shaped by people, through human agency, through will, and through our capacity to govern ourselves. This matters most when a model predicts an outcome we would not or should not choose. A forecast of harm is a warning. If we let an agent act on it, the agent may help bring that harm about. When a prediction points toward a bad outcome, the better response is to change the prediction. The same trap applies to us when it comes to AI itself. Some say AI may end the world. I understand the concern. Yet if we accept that prediction as destiny, we stop working to prevent it, and it becomes more likely. A prediction like this is a call to act. We change it through how we govern AI. So when I look at AI agents that act on predictions, I find myself asking three questions. Is the future this agent predicts one we want? Are its actions helping to make that prediction come true? If the prediction is unfavourable, what are we doing to change it? This is where compliance and assurance come in. Some suggest the key question for AI governance is whether an agent's decisions are admissible, meaning within acceptable limits. That is conformance. It matters, but it is not enough. An agent can make only admissible decisions and still carry us toward a future we never intended. Assurance asks a different question: are we on track to keep our promises and achieve the outcomes we committed to? An agent acting on a prediction pursues the model's future. Governance steers toward ours. Decision-making is not deterministic, and for good reason. It is where human agency and judgment are exercised. It is where a future is created, not just reacted to. An agent that acts on a prediction as if it were reality makes the decision deterministic. We should keep that decision with people, including the decision about how the AI story ends.

Digital Engineering as Strategy Organizations in high-risk industries are under pressure to adopt AI. They also carry commitments to regulators, workers, customers and the public. AI can help keep those commitments when it is engineered to do so. That requires being able to answer three questions at any time: - Are we on mission? - Are we operating between the lines? - Are we ahead of risk? Most organizations answer these after the fact, through audits, reports and reviews. Adding AI tools to the same approach produces faster reports about risk already taken. Digital engineering gives AI the structure it needs to help answer these questions as you operate. A digital twin connects what the organization has promised with how it actually operates. Institutional information guides the twin: your values and commitments, the guardrails and controls you have put in place, and your regulatory and stakeholder obligations. Sensors bring in what is happening in the real world. AI, working from knowledge models and within engineered guardrails, turns that into prediction, planning and regulation. Decisions flow back to the organization and change how the work is done. This foundation delivers intelligent digital services: 🔸 Digital shadow: a current view of how you are performing against your commitments. 🔸 Decision support: guidance before the point of decision. 🔸 Autonomous control: automated action within defined guardrails. 🔸 Learning system: an organization that improves with every cycle. Each service operates within the obligations and guardrails that govern the twin. People remain accountable for the decisions that matter. Digital engineering is how high-risk organizations use AI to design, build, operate and regulate, so they stay on mission, between the lines and ahead of risk. That makes it a strategy.

We have been here before. In the enterprise, there have always been two kinds of searches. The first looks for the exact answer you get from a query (deterministic). The second looks for the closest answer you can find through full-text search (probabilistic). We knew the difference, and we learned how to use each kind. Full-text search gave us the approximate answers. It returned a ranked list of the most relevant results — useful when you are browsing, less so when you need the emergency shutdown procedure. But it presented its results as what they were: ranked, approximate, and left to your judgment. AI does not. It returns its most probable answer as though it were the answer, with no ranking and no indication of confidence. Some of what it returns is accurate, some is close, and some is invented outright — presented together, with nothing to tell them apart. And AI doesn't tell you which is which. Ask for the emergency shutdown procedure and there is a correct answer and an incorrect one. The procedure AI returns may be close to the one you need, or synthetic — created in real time. Either way it is presented with the same confidence, and the two are difficult to tell apart. However, using the wrong procedure may result in serious consequences. For AI to be reliable in the enterprise, it has to do what full-text search never had to: handle both kinds of answers at once. It has to draw the exact answer from structured records and the approximate one from documents, and distinguish between them — returning facts as facts and predictions as predictions. That is the difficult part. It is doable. However, it is not yet being done.

Ethical Decision Making Involving AI In the domain of Corporate Ethics and Compliance, one hammer is used to establish ethical behaviour – training. In many cases, this training consists of the transfer of knowledge with respect to rules, regulations, and code of conduct. While this is important, it will not be enough to handle concerns associated with Artificial Intelligence (AI) systems and its use. What is missing from many organizations are the skills to make ethical decisions which have more to do with values and meaning rather than measurements and metrics – qualitative rather than quantitative decision making. These skills are no longer valued by some in favour of algorithmic and numerical decision making otherwise known as machine-based decisions. How will organizations keep humans in-the-loop when the loop no longer involves human decision making? This is where compliance comes in. Compliance at its core is an ethical endeavour to stay between the lines and ahead of risk. When decisions are made to proceed with a course of action, for example, to use or not use AI, in the presence of uncertainty where there is a possibility of loss or harm, we are making an ethical choice. The commitments that are then made reflect the values we have prioritized. Unfortunately, all too often, top management goes straight from setting a course of action to specifying boots-on-the-ground tasks. It's no wonder why corporate and ethical compliance are struggling. Ethical dilemmas are not considered, risk is not evaluated, and operational capabilities are not adjusted to stay between the lines and ahead of risk. Frankly, the message now seems to be, "attend the training and do the tasks." In the not too recent past, middle management used to do the translation work between top management and boots-on-the-ground activity. But no longer as many have removed these roles to flatten their organizations. The skill of making ethical decisions now resides with those who directly own the obligations and compliance teams. We offer an online training course on, "Ethical Decision Making Involving AI." You will learn how to make ethical choices supporting responsible and safe AI along with your other compliance obligations. Reach out to us if interested. https://www.leancompliance.ca/contact

When we talk about AI adoption, most people mean efficiency. Making existing processes faster. Swapping one process stack for another. Here's the thing. With what has been borrowed against AI, efficiency does not come close to settling the account. Because that is what this is. A debt. We have directed much of the world's capital into a single technology and away from everything else it could have funded. That capital was not free. It was borrowed against a promise. And capital is only part of what was drawn down. The data centres behind AI run on staggering amounts of energy and water. Their electricity demand is on track to double by 2030 — to roughly 945 terawatt-hours a year, more than all of Japan consumes. Power that could light homes and run hospitals. Fresh water, by the millions of litres, poured through cooling systems to keep the servers cold. Water that could grow food and fill reservoirs. Every model trained, every query answered, draws down resources that are already scarce — and not available to people who need them. So the account is large, and it is still open. Against it stands the promise. One day, we were told, AI would help cure cancer, reduce hunger, clean up pollution, make life more viable for everyone. That was the note we signed. That was the collateral we put up. So where is the payment going? Not toward those problems. Toward compute centres, power generation, GPUs, memory. The machinery of something its builders call AGI. Here is why that was never going to end any other way. Cybernetics has a law for it: the law of inevitable ethical inadequacy. Stated plainly — if you do not require a system to be ethical, you will not get one. You get a system that optimizes for the goals you specified, at the expense of the ones you did not. The ethical. The human. The good. And those goals are set by us. Not by the machine — by the people who build it and fund it. The system does what it is told. We are the ones doing the telling. So the inadequacy is not the machine's failing. It is ours. Look at what we made a requirement. Capability. Scale. AGI. Then look at what we left as a promise. Cancer. Hunger. Pollution. A better life for everyone. A promise is not a requirement. And a system built to hit the goals we set will spend every borrowed dollar, every watt, every litre on hitting them harder — not on the good we never required of it. So the default was built in from the start. In both senses of the word. The outcome defaults to what we specified, and the debt defaults unpaid — because repayment was never written into the terms. What is being built looks like a future without us. Not one where we do better. That is not a betrayal of the goal. It is the goal, working exactly as specified. The bill does not disappear because we spent it elsewhere. If AI is going to cost us this much — our capital, our power, our water, the things we need to live and grow our society — then the good cannot stay a promise. It has to become a requirement. Written into the terms. Measured in what we were told AI would deliver. Cancer. Hunger. Not process cycle times. That is what is owed. Specify the good, or it will not come. That is the only way AI ever delivers the goods.

Audit Will Not Make AI Safe Ask almost anyone in compliance where the field ought to be heading and the answer comes back the same. Compliance should become proactive. It should anticipate risk rather than react to it. It should build the capability to meet obligations, not merely the paperwork to prove them. The obligations themselves have already moved. Regulation and standards have shifted toward risk-based and outcome-based designs, and they now ask organizations to contend with uncertainty and achieve results rather than follow prescription alone. There is broad agreement on the destination. What is remarkable is how little the practice of compliance has moved, even as the obligations already have. I wrote a few years ago that compliance needs to change, and that the reactive model most companies still run has been quietly working against the very outcomes they are trying to achieve. That is still true. What I did not name clearly enough at the time was the reason the reactive model persists. It persists because the audit regime holds it in place. Audit is not a neutral check on compliance. Audit is the mechanism that keeps compliance reactive. Reactive by Design Consider what an audit actually does. It samples evidence after the fact. It compares that evidence against documented procedure. It produces findings, and those findings are closed through corrective action. Every part of that sequence looks backward. An audit can tell you what already happened. It cannot tell you what is about to. I made a related point in the earlier paper. There is an important difference between verifying what has already happened and preventing what has not yet happened. Financial audit was built for the former. Safety, quality, and risk live in the latter. When we borrow the financial audit model and apply it to outcomes that have not yet occurred, we are using an instrument built to look back as though it could look forward. It cannot. The reactivity is not a flaw in how audit is practised. It is what audit is. The Vicious Cycle A reactive instrument is a problem on its own. What makes it worse is that the burden does not stay fixed. It grows with every cycle. Each finding is closed by adding something: a control, a checkpoint, a document. More procedure creates more surface to audit. More surface produces more findings. More findings produce more procedure. The apparatus grows on its own momentum, and every increment of complexity introduces new ways to fail and new things to inspect. The mechanism meant to correct the system is the same mechanism that inflates it. This is the pattern behind the misuses I described before. When audit findings are treated as requirements, the ratchet turns, and the auditor's interpretation becomes the obligation the program must now grow to satisfy. When companies run pre-audits to prepare for internal audits to prepare for external audits, the parallel apparatus has already taken over. An entire second system now exists whose only purpose is to prove compliance to someone else's uncertain benchmark. What I once catalogued as four common misuses are not accidents of poor practice. They are what a reactive instrument produces when a company relies on it. Two forces make the cycle worse. The first is that people begin to manage the measure instead of the outcome. Because the audit scores what can be documented, effort migrates toward looking compliant, and a company can become very good at passing audits while becoming no safer at all. The second is that the work of feeding the audit crowds out the work of building capability. The busier a company is closing findings, the less time it has to prevent the next one, and so it stays perpetually behind. Assurance Does Not Come From Audit Here is the point we keep getting wrong. Compliance does need assurance. Regulators, boards, and stakeholders are right to want confidence that obligations will be met, and not only that they were met once. That confidence does not come from an audit. It comes from capability. Assurance is the confidence that a company can keep its promises today, tomorrow, and every day after. No inspection can manufacture that. An audit can attest to a moment already past. The capacity to meet an obligation in the future is a property of how the work is designed, resourced, and operated. It is built into the organization, or it is not there at all. A certificate on the wall says a sample looked acceptable on the day it was taken. It says nothing about whether the capability exists to keep the promise tomorrow. This is the mistake compliance has made for decades. We have treated assurance as something an auditor confers rather than something an organization possesses. We are now about to make the same mistake, at scale, with AI. The Same Mistake, Now Applied to AI New regulation for AI is arriving, and the predictable response is already taking shape. The audit regime will stand up to meet it. Certification schemes, conformity assessments, and audit checklists are being assembled to answer the new obligations in the only language the existing apparatus knows, which is documented conformance verified after the fact. We should see where this leads, because we have watched it before. Most businesses will not build safety into their AI systems. They will hire external auditors to certify that they have the appearance of being safe. The certificate will attest to a snapshot. The behaviour of the system in the world, which is precisely the thing that matters and precisely the thing that changes, will go unaddressed. The vicious cycle will reassert itself, the same misuses will follow, and organizations will feel more protected while becoming less safe, at a moment when the distance between appearing safe and being safe carries far greater consequences than it ever did before. AI does not tolerate a reactive compliance model. Its behaviour is variable, fast, and often novel. An instrument that samples the past cannot regulate a system whose risks are still forming. The range of what can go wrong outruns anything an audit checklist can hold. Applying the audit regime to AI is not a partial solution that time will improve. It is a category error, and it will give companies confidence in exactly the wrong thing. But We Still Need Independent Assessment The most common objection to all of this is that organizations still need independent assessment. They do. Independence has real value, and nothing here argues against it. The objection skips over the only question that matters, which is what the independent assessor is actually assessing. Asking this plainly. Does the auditor assess the level of safety a system has achieved? Does the auditor assess the organization's capacity to remain safe as conditions change? In almost every case the answer is no. The auditor checks whether the documentation is in order and whether procedure was followed. That is an assessment of the appearance of safety. It can be independent, rigorous, and still beside the point. Independent assessment is worth keeping. What has to change is what it assesses. An assessor should be asking whether the organization is safe and whether it can stay that way. That is a question about real capability, not about whether the documents are in order. Point independent assessment at the capacity to be safe rather than the appearance of it, and independence becomes an asset again instead of a ritual. What This Requires It comes down to one question. Where does assurance come from? Assurance has to be built. It cannot be inspected into existence. It belongs in the first line, where managerial accountability exists. The people who do the work produce the assurance, because no one else can. That means designing compliance into the work, not bolting an audit on at the end. It means measuring capability, not just documents. It means moving the feedback ahead of the harm, so a company knows it can meet an obligation before it is tested. Verification still belongs inside this system. What changes is that it serves capability instead of standing in for it. Audit can tell us what happened. Only capability can assure us of what will. That difference has always mattered, and with AI it becomes decisive. A system whose behaviour is fast, variable, and still forming will not be made safe by a certificate that attests to a moment already past. It will be made safe by building the capability to stay safe, and by assessing whether that capability is real. Every organization adopting AI now faces the same choice. Build safety in, or buy the appearance of it. Only one of them makes you safe. Building safety in has a name. I call it Forward Assurance. It builds the capability to be safe into how an AI system is designed and run, and it gives the organization ongoing evidence that the capability is real and working. It shows whether you can meet your AI obligations today and keep meeting them, not whether you passed an audit last quarter.

Investing in the Opportunity to Succeed Every business creates value under uncertainty. Some of that uncertainty can be reduced. It comes from what the organization does not yet know. About its processes. Its risks. Its obligations. The conditions it works in. Learning reduces it. So does capability. This is uncertainty you buy down. Some of it cannot be reduced. Variation is part of real conditions, and no amount of learning removes it. This is uncertainty you contend with by creating margin. Businesses succeed when they do both. They buy down what can be known. They hold margin against what cannot. Where compliance fits Compliance programs are how organizations buy down uncertainty. Uncertainty about their obligations, and uncertainty about the outcomes of those obligations. Every obligation carries the risk that it will not be met. A regulation. A commitment. A promise to a stakeholder. Until the organization has the capability to deliver on it, whether it gets met is an open question. A compliance program closes that question. Not by documenting the obligation, but by building what it takes to meet it. The outcomes carry uncertainty too. Safety is not produced by meeting safety obligations alone. Neither is security, or quality, or sustainability. Each one is something the organization is working toward in conditions it does not fully control. The compliance program is what reduces the uncertainty of getting there. Margin is the other half. Where uncertainty cannot be reduced, the response is buffer, tolerance, and reserve. Enough room that variation does not become failure. This is why compliance measured against profit alone misses most of what it produces. What Total Value accounts for Businesses create more than profit. Reputation. Integrity. Quality. Safety. Security. Sustainability. And underneath all of them, stakeholder trust. These are outcomes the organization has committed to and stakeholders rely on. They are also the outcomes most exposed to uncertainty, because each one depends on something going right that could have gone otherwise. Total Value accounts for all of it. What a business earns, and what it protects and ensures. The third advantage Michael Porter identified two sources of competitive advantage through value chain analysis. Cost and differentiation. Compete on price, or compete on what the product does. There is a third. An organization that reliably delivers on what it has committed to earns something competitors cannot easily copy. It stays between the lines, ahead of risk, and on mission. Stakeholders come to rely on it. That reliance is difficult to build and slow to lose. We call this the Total Value Advantage. It does not come from managing compliance more efficiently. It comes from building the capability to meet obligations, and from contending well with the uncertainty between an obligation and its outcome. Is your compliance ready for the age of intelligence? The Compliance Readiness Scorecard gives you an honest picture of where your program stands — and a strategic conversation about what to do next. https://www.leancompliance.ca/compliance-readiness-scorecard

Forward Assurance for AI Systems Audit looks backward. It verifies that something was done. Forward assurance is confidence that a system will keep its promises in operation — and that confidence cannot be inspected in after the fact. It is engineered in, by design. The gap AI is adopted when it can be trusted with the work that matters. We trust a mission critical system because we trust the people who design and build it, and the discipline they follow. That is what has to be established, and mostly it isn't. Most of what is offered to close this gap checks the output, attests to it, or reports on it. None of it establishes that the work itself was done to engineering and regulatory standards. Engineering is how the gap closes We provide consulting services to help you establish engineering practice that meets professional standards — applying the methods, technical standards, and disciplines that govern how AI systems should be engineered, such as ISO/IEC 5338 and others that apply. The result is a practice that creates trust because AI systems are engineered by competent and trustworthy practitioners, following proven engineering methods to professional and regulatory standards. Three disciplines, working together → Engineering Methodology — how AI systems are engineered for the enterprise: architecture, capability requirements, risk-based phasing, and separation of concerns. → Project Assurance — independent engineering judgment over the build: stage-gating, acceptance criteria, and design review that keep each phase sound enough to support the next. → AI Compliance — compliance engineered into the system from the design stage: obligations, controls, and the regulator structure built into the architecture, not bolted on after. Who this is for Data, software, and IT solutions firms putting AI into client work. Organizations pursuing licensed engineering practice or a Certificate of Authorization. Engineering and delivery teams standing up AI capabilities to professional and regulatory standards. Organizations bidding into regulated or public work, where engineering assurance is the basis they compete on. If you are working to put real engineering practice behind your AI, reach out. https://www.leancompliance.ca/forward-assurance