Common Failures, Listed

At the start

Banning before providing. Signal: a prohibition with no approved alternative. Fix: provide first, then restrict.

The recommendations in “Common Failures, Listed” become easier to sustain when implementation work has visible owners, dates and review time. Teams evaluating online timesheet software can use it to coordinate the operational side of AI adoption and identify where governance tasks are being missed, without treating activity data as evidence of misconduct or as a substitute for asking people why they chose a tool.

For an independent benchmark, compare the local approach with NIST AI Risk Management Framework; the useful test is whether ownership, access and recovery remain proportionate and explainable when the usual expert is absent.

Discovery run as a hunt. Signal: somebody faced consequences for a finding. Fix: not available — the next exercise will produce quiet answers.

No owner with allocated time. Signal: this is somebody's fifth priority. Fix: half a role, or run the cheap discovery and use it to argue for one.

In the rules

Tool-based rules. Signal: a policy naming products. Fix: write it about data classification instead.

No classification scheme. Signal: the policy says "confidential" and nobody can apply it. Fix: three levels and five examples each.

A policy nobody can state. Signal: it runs to six pages. Fix: one page, four rules.

Only prohibitions. Signal: no statement of what is allowed. Fix: say that ordinary drafting and summarising are fine.

In the monitoring

Content inspection by default. Signal: it was configured, not decided. Fix: check what the tooling collects against what was agreed.

Individual visibility as standard. Signal: anybody can filter to one person. Fix: a minimum group size and a named approver.

Monitoring without telling people. Signal: they found out from each other. Fix: not recoverable.

In the operation

Exceptions that take weeks. Signal: a high proportion refused and low request volume. Fix: a named approver and a two-day target.

Never measuring the switch. Signal: a rollout recorded as complete with no traffic comparison. Fix: one query against the destination logs.

The pattern

Seven of the twelve are fixed in under a month.

Three are prevented only at the start: the amnesty, the owner, and telling people about monitoring.

And two are not recoverable — a discovery exercise that produced consequences, and monitoring people found out about. Both are trust rather than technology.

The order to fix them

If you do one thing: provide a good approved tool and provision it by default.

If two: write the one-page classification policy.

If three: measure whether consumer use fell.

Those three cost about a month and address most of the twelve.

What to check

Which of the twelve do you have?

Are any of them the two that cannot be undone?

Which is cheapest to fix?

And has anything from your last review actually changed?

The point

Two of the twelve failures cannot be undone: a discovery exercise that produced consequences, and monitoring people found out about themselves..

Underlying all of this

Everything in this collection reduces to four habits: find out what people are doing and why before deciding anything, provide something good enough that the approved route is the easy one, write rules about information rather than about tools, and monitor the destination rather than the content. None requires a product, and a programme doing all four controls more than one built on prohibition.

The recurring pattern

The recurring pattern across every section here is the same: the response that feels like control reduces it. A ban removes visibility rather than use. Content inspection drives activity to personal devices. A discovery exercise with consequences produces quiet answers. In each case the organisation ends up knowing less about a risk it believes it has handled.