Lessons Learned Registry

The lesson:

One-time vendor assessment is insufficient. Third-party risk assessments must be periodic (every 6 months for critical vendors) with continuous access control review. We added a mandatory periodic review clause to all new vendor contracts.

The lesson:

Every material organizational change must automatically trigger a review of affected committee charters. We created an organizational change checklist that includes charter updates as a mandatory item within 30 days.

The lesson:

AI models in people-impacting decisions need continuous bias monitoring, not just launch-time evaluation. We established a monthly fairness metrics dashboard with automatic alert thresholds.

The lesson:

Explicit consent means clear affirmative action — no pre-checked boxes, no bundled purposes, no vague wording. We redesigned all consent forms with a "one purpose per consent" principle.

The lesson:

No "urgency" justifies bypassing change management — there should be an expedited path with minimum controls instead. We created an "emergency change" track that reduces time but preserves technical review and approval.

The lesson:

Collecting data without aggregate analysis is just archiving. We converted exit interviews into a structured survey with a quarterly analytics dashboard presented to leadership.

The lesson:

Each change request looks small individually — the risk is in accumulation. We created a "scope balance" tracker that monitors cumulative impact of every change request and alerts when thresholds are exceeded.

The lesson:

Estimating migration time based on volume alone is a recipe for delays. We added a mandatory "data quality assessment" phase before any migration, with a 3× correction factor for legacy unstructured data.

The lesson:

Security awareness must be role-tailored — executives need different training focused on BEC attacks and artificial urgency. We launched a dedicated executive-level awareness program.

The lesson:

Internal policy definitions must align with — or be broader than — regulatory definitions. We added an annual definition reconciliation review against the latest regulations.