Welcome to the inaugural episode of Karmine Kompass: Pivotal Conversations!
We kick off our journey to excellence with Shreyas Tonse of Zensible, the world’s first Total Experience (Tx) company in HR technology. This conversation is your roadmap to understanding the strategic shift needed to succeed in the digital-first era.
We dive deep into why enterprises need to stop viewing HR software as fragmented tools and start treating it as a unified, strategic ecosystem that maximizes business value and employee experience.
Karmine Consulting is dedicated to guiding leaders through pivotal conversations. Subscribe for weekly insights that inspire, ignite, and align your business strategy.
For some time now, the “money mule” typologies have largely involved vulnerable individuals who were persuaded or coerced into moving illicit funds. Today, that typology is shifting into exploiting legitimate business current accounts, especially those belonging to MSMEs, to layer and route illicit funds at scale. This evolution is not just tactical; rather, it represents a well thought out reconfiguration of how criminal networks exploit the trust fabric underpinning the financial system.
Recent cases reported across Indian banks highlight how MSME accounts are being hijacked, rented, or compromised to facilitate fast-moving, high-velocity transfers. This trend is accelerating, and financial institutions must re-evaluate their fraud detection and prevention strategies before systemic trust erodes any further.
Business Accounts – New Mule Infrastructure
1. Higher Transaction Thresholds
Business current accounts routinely handle large-value transactions. A ₹3-5 lakh credit in an MSME account appears routine, whereas the same amount would seem anomalous in a retail account. This gives fraudsters a degree of anonymity through normalcy.
2. Legitimacy and Established History
Contrary to newly opened personal bank accounts, corporate entities generally come with a certain level of banking history, GST filings, payroll patterns, and vendor relationships. This legitimacy provides the necessary camouflage for fraudsters to move funds through current accounts.
Often attributed as “Rent-a-Current-Account” model, struggling businesses, especially those with credit stress, rent their accounts for commissions where funds are layered through vendors, wallets, and forex channels before exiting the system.
3. Lower Behavioural Predictability
MSME activities differ dramatically across sectors based on their seasonality, client mixes, and growth cycles. This diversity makes it difficult for traditional transaction monitoring systems to establish a baseline for what “good” account behavior looks like.
4. Insider or Peripheral Collusion
Fraudsters capitalize on dormant partners, distressed business owners, accountants, or even compromised vendor relationships. In other cases, attackers gain access through identity compromise, or invoice-manipulation attacks.
Criminal networks now favor “fewer, high-trust mule accounts” over a network of small retail mules, allowing them to transfer larger volumes with reduced exposure.
5. Account Takeover via Business Email Compromise
Cybercriminals compromise corporate email systems, intercept invoices, alter payment instructions, and quietly redirect funds into compromised or rented business accounts.
6. Shell Firms Masquerading as Genuine MSMEs
Criminals create fully documented shell companies, complete with incorporation proofs, basic trade activity, and GST registrations, to simulate legitimacy while acting as laundering pipelines.
The common thread across all three is the exploitation of blind spots within traditional bank surveillance and due diligence procedures.
Why Traditional Controls Fail
1. Static KYC cannot keep up with dynamic risk
KYC establishes identity at the time of onboarding or during periodic refresh, but businesses often evolve faster than the KYC cycle, sometimes into riskier entities. Without dynamic risk-refresh mechanisms or perpetual KYC procedures, banks remain blind to behavioural drift.
2. Typical transaction monitoring typologies not designed for MSME complexity
Rule-based transaction monitoring engines falter with MSMEs whose cash flows are non-linear, seasonal, and shaped by sector dynamics. As a result, generic rules either flood systems with false positives or miss detecting targeted mule activity.
3. Lack of entity-resolution across accounts & identities
A business is not a single account, rather it is an ecosystem of promoters, directors, accountants, devices, IPs, and counterparties. Legacy systems struggle to connect these signals and form a unified risk picture, analyzing each data point in isolation which creates blind spots that delay detection and prevents banks from recognizing coordinated or evolving threats across the wider business ecosystem.
4. Limited Visibility Beyond the Bank’s Perimeter
Fraud patterns often spread across institutions, but without consortium-level intelligence or federated learning programs, these signals stay under the radar. Fraudsters take advantage of this fragmentation, moving quickly between institutions to stay ahead of detection.
Building Models that work – Our Perspective
The surge in business-account mule activity highlights a crucial industry lesson: fraud cannot be solved through transaction monitoring alone. Detecting mule behavior, particularly in corporate accounts, requires multi-dimensional intelligence that connects digital signals, human context, and behavioural narratives.
Karmine’s perspective centers on four essential pillars.
A robust Customer 360° framework brings together identity, device, and behavioural signals across both retail and corporate profiles and integrates fraud and AML so that indicators such as account-takeover attempts or suspicious logins strengthen AML risk scoring. It also incorporates network-level intelligence to reveal links to shell firms, risky beneficiaries, or high-velocity counterparty rings.
Traditional systems often treat fraud and AML as separate domains, even though mule activity sits directly at their intersection. A single, entity-level view can uncover risk patterns that often get missed in siloed systems.
Only when a bank views the business as a single, holistic entity, rather than as a collection of accounts, can mule activity be detected in time.
2. Early Risk Signals Appear Long Before Transactions Do
Documentation inconsistencies, KYB anomalies, and behavioural red flags often emerge months before any transactional anomalies surface. These early signals provide valuable insight into whether a business is stable, legitimate, and operating as declared.
Examples include mismatches between the stated nature of business and actual financial flows, templated or recycled incorporation documents, unexplained changes in ownership or authorized signatories, and income lines or operational footprints that do not match the speed of fund inflows. These indicators often hold predictive value and can highlight elevated risk before money movement becomes suspicious.
To use this intelligence effectively, banks must integrate these non-transactional signals into their ongoing monitoring processes. When onboarding and KYB data is treated as one-time paperwork instead of continuous risk input, institutions lose early warning capabilities that can prevent misuse long before transactional behavior deteriorates.
3. Relationship Managers – crucial interpreters of customer behavior
For corporate and MSME segments, Relationship Managers (RMs) are a primary source of contextual understanding. They know their clients’ operational realities, seasonality, and market cycles, yet in most banks the RM layer remains disconnected from fraud and AML signals.
To be effective, RMs need the ability to spot deviations between expected business behavior and actual transaction flows, escalate sudden shifts in volume, beneficiaries, or geographies, and validate whether a company’s banking behavior aligns with the patterns observed. Digital intelligence can detect anomalies, but only human context can explain them.
4. Strong, Continuous KYC/KYB – A Non-Negotiable
The shift from a legitimate business to a mule entity is often gradual, which makes static KYC frameworks insufficient on their own. A more continuous, risk-based KYB approach is needed, where updates are prompted by behavioural changes rather than waiting for a scheduled refresh.
In practice, this means keeping an eye on sector-specific cash-flow patterns, checking whether the business model still appears viable, and periodically validating key details such as income sources, counterparties, staffing, and day-to-day operations. Simple, contextual risk scoring can help highlight when a business begins to deviate from its usual activity. In this model, understanding how a business operates becomes just as important as confirming who owns it.
How Karmine Consulting can help
For banks dealing with MSME portfolios, the real challenge is not just detecting mule accounts but understanding where and why the current system is blind. As a boutique AFC consulting firm, we aid institutions across some of their core considerations:
Governance & Risk Profile: Build a sharper, enterprise-level view of their MSME mule risk profile by identifying which sectors, clusters, ownership patterns, and transaction behaviors create the highest exposure.
Data: We aid in mapping data landscape end-to-end, assessing where relevant signals sit across KYC, GST data, account behaviors, trade documents, RM logs and counterparty flows and how much of this can be orchestrated to strengthen detection without waiting for multi-year modernization.
Process: We help refine processes for faster identification and cleaner reporting, redesign accountability structures across the three lines of defense, and define the RM/analyst skill sets needed to distinguish legitimate MSME churn from mule activity.
Tech: Finally, we help banks pinpoint the exact tech investments that will move the needle across entity resolution, network-graph analytics, document forensics, or continuous-KYC triggers.
Through our interventions, we help ensure institutions build a scalable, intelligence-led MSME mule-detection capability rather than repurposing retail-focused controls
Artificial Intelligence has moved from being a buzzword in boardrooms to a daily reality in workplaces, from streamlining operations and assisting with customer service to powering creative brainstorming. As generative and agentic AI integrate into workflows, the success of AI doesn’t hinge on having the most advanced model – it depends on people. Without readiness, even the slickest of tech can fall flat. The World Economic Forum highlights that while AI could create as many as 170 million jobs by 2030, around 92 million may be displaced in the same period. These shifts show that building AI-confident workforces isn’t just about technology – it’s a human capability and cultural priority essential for navigating both opportunity and disruption.
The Human Side of AI Adoption
AI is already at scale. IBM’s Global AI Adoption Index 2023 reports that 42% of enterprises have implemented AI, and another 40% are experimenting. Yet many employees still approach AI with hesitation. An EY study found that 71% of U.S. employees worry about AI, nearly half reporting increased concern over the past year. Three-quarters fear job loss, and 65% doubt their current roles will survive. These concerns are widespread and cannot be ignored.
Resistance stems from uncertainty and overwhelm – employees question whether AI might make their roles redundant, if they can master unfamiliar tools, or whether using AI will be seen as taking shortcuts. This reflects not just skill gaps, but a lack of confidence and cultural readiness.IBM’s AI Readiness Index shows less than half of companies feel prepared for widescale integration. Organisations ignoring this emotional layer risk stalled adoption and derailed transformation.
Readiness is not about buying software licenses; it’s about building behavioural and cultural foundations that help employees feel capable and safe to use AI. With AI advancing rapidly – 44% of core skills expected to be disrupted within five years (WEF) – organisations must turn resistance into readiness, shifting the focus from “Can we implement AI?” to “Can our people embrace it?” By fostering curiosity, resilience, and behavioural competencies, employees to grow alongside AI, boosting adoption, and creating agile, innovative, and future ready workforce.
Mindset Shift: From Resistance to Innovation
Shaping an AI-confident workforce requires a deliberate mindset shift. Employees must be geared towards perceiving AI as an enabler, and not as a competitor. Storytelling plays a big role here, sharing examples of how AI has solved customer pain points, reduced tedious tasks, or unlocked creative potential. When employees experience tangible wins, their resistance gives way to curiosity.
This cultural shift has been particularly visible in organisations like HCLTech, where large-scale reskilling efforts have been undertaken, with the premise that “AI is being introduced as a co-pilot to augment human capabilities, not replace them” This lays emphasis on upskilling employees to take on higher-value tasks. The framing of AI as a colleague at the workplace, rather than a rival helps employees embrace the technology more readily.
Embedding Social & Experiential Learning
Traditional training – static modules, one-off workshops, or lengthy e-learning courses – focuses on information transfer but rarely supports habit-building or real-world confidence. That’s why many employees end up tuning out. A study on Microsoft 365 Copilot found employees often skipped formal onboarding videos, preferring hands-on use and peer discussions. This highlights a broader truth: people build confidence with AI not by passively consuming information, but by experimenting, sharing insights, and reflecting together.
Hands-on experience with AI, especially its limitations, fosters realistic expectations and trust, particularly when supported by peer networks and champions. Organisations that translate these insights into governance structures achieve more sustainable adoption. AI readiness evolves through cycles of individual understanding, social learning, and organisational adaptation. These insights suggest that organizations should approach AI adoption not as a one-time implementation but as an ongoing strategic learning process that balances innovation with practical constraints.
For organisations, this means shifting from one-off training modules to a more dynamic approach: creating opportunities for collaborative experimentation, peer-to-peer learning, and coaching. When employees can practice, question, and learn from each other, AI adoption shifts from a top-down mandate to a shared journey of growth, making technology both accessible and meaningful.
Building the Core Competencies
So, what does it take to nurture an AI-confident workforce? The answer lies less in technical skills and more in behavioural competencies that prepare employees to work in dynamic, uncertain environments.
Embracing Ambiguity and Change AI is evolving faster than any traditional business process. Employees who can handle ambiguity – who don’t freeze when outcomes are uncertain – are more likely to adapt successfully. When DHL introduced AI-enabled voicebots to handle customer instructions in Germany, employees who were open to change engaged with the technology as an assistant, while those resistant to ambiguity initially viewed it as an intrusion. Over time, the organisation supported the transition by framing AI as a tool to free up capacity rather than replace jobs.
Adaptability and Resilience Adaptability is the willingness to pivot, and resilience is the ability to bounce back after disruption. Together, they form the backbone of AI readiness. At Goldman Sachs, more than 10,000 employees began using the firm’s in-house AI assistant to streamline research, coding, and client communication. Rather than resisting, teams adapted quickly, experimenting with how AI could ease daily pressures while still validating outputs with their expertise. This balance of flexibility and discipline illustrates how adaptability and resilience help employees not just absorb new tools, but sustain performance during change.
Learning Agility Learning agility is the readiness to learn, unlearn, and relearn continuously. In environments where AI tools change every few months, this is essential. Microsoft’s developer study showed that over 75% of developers now use AI assistants regularly, and nearly 90% report feeling more productive. What drove adoption wasn’t formal training videos but the willingness to experiment, test, and learn in real time. Organisations that encourage small-scale experimentation and peer learning see faster adoption than those that rely on traditional classroom training alone.
Digital Confidence and Critical Thinking Confidence in using technology is about trusting oneself to explore, troubleshoot, and evaluate outputs critically. AI is powerful, but not always accurate. Employees with digital confidence and strong critical thinking skills are better at spotting errors, questioning biases, and deciding when human judgement must override machine recommendations. ANZ Bank conducted a six-week experiment with GitHub Copilot involving around 100 engineers, and the results showed a significant productivity increase-tasks were completed 42.36% faster by engineers using Copilot compared to those who did not. Alongside productivity, their ability to critically evaluate AI-generated code ensured quality didn’t suffer.
Creativity, Innovation and Growth Mindset Paradoxically, AI doesn’t diminish the importance of creativity – it amplifies it. With AI handling repetitive tasks, employees are freer to experiment and innovate. A growth mindset – the belief that skills can be developed through effort, helps employees view AI not as a threat but as an opportunity to push the boundaries of what’s possible. PwC Australia has shifted its recruitment criteria toward these human-centred qualities, such as curiosity, collaboration, and ethical judgment over traditional technical checklists. Their reasoning is simple: in a world where AI evolves daily, the best long-term asset is human adaptability, creativity and emotional intelligence.
Collaborating with AI: Shaping New Working Models
For AI to feel more approachable, it must weave into daily workflows in simple, meaningful ways – summarizing long reports, drafting emails, or assisting with research.
Deloitte UK’s in-house AI chatbot, PairD, illustrates this: audit staff interacting with chatbot monthly rose from 25% to nearly 75% in a year, generating over 1.1 million prompts between April 2024 and February 2025. Employees use it not just for basic questions but to develop complex prompts, assisting with document summaries, coding, and data analysis. The focus is on freeing up time for deeper analytical work showing that AI’s value lies in hands-on, embedded collaboration.
Agentic AI takes this further by acting semi-autonomously. Unlike reactive tools, it anticipates, flags errors, proposes next steps, and can carry out actions independently, like rescheduling shifts or managing interview schedule.
McKinsey points out how agentic AI is reshaping talent workflows. Instead of waiting for recruiters to prompt each step, these systems can scan resumes, shortlist candidates, and even line up interview schedules on their own. What comes back to the recruiter isn’t raw data, but a refined set of options to review. This frees people to spend their energy where it matters most – making judgements, building connections, and applying empathy.
Effective worker-AI coexistence depends on cultivating “agentic behaviours”: intentionality, proactivity, adaptability and collaboration. Embedding these behaviours ensures AI aligns with human values and business goals, turning technology from a tool into a true collaborator that amplifies productivity, innovation, and human judgment.
Real-World Rewards of Building AI-Confident Workforces
When employees embrace AI confidently, Worker-AI coexistence turns into more than faster work – it creates smarter, bolder, and more adaptable teams. The real gains appear in innovation, resilience, and a workforce ready for the future.
Productivity gains that go beyond efficiency At Microsoft, developers using GitHub Copilot reported completing tasks up to 55% faster, with some workflows showing 90% higher productivity. Beyond speed, employees felt empowered to tackle more creative and complex work, reflecting behaviours like curiosity, learning agility, and confidence in experimenting with AI. This shows how AI-ready behaviours amplify both efficiency and quality, not just output volume.
A stronger culture of innovation and adaptability At DHL, AI is embedded into logistics planning and warehouse operations, but the real transformation comes from employees. Staff trained to engage confidently with AI-driven tools are not only executing tasks more effectively they actively suggest improvements, experiment with new approaches and share insights on operational efficiencies. This behaviour reflects adaptability, curiosity and proactive problem-solving. As a result, the organisation benefits from a culture where innovation emerges bottom-up, employees feel empowered to influence processes, and adaptability becomes a shared competency, not just a technology-driven outcome.
Talent retention through future-proofing careers Employees increasingly look for employers who invest in reskilling and help them stay relevant. Business Insider highlighted that workers are more likely to stay loyal to companies that actively prepare them for an AI-enabled future. By cultivating behaviours like continuous learning, openness to new tools, and self-driven development, organisations signal commitment to people, boosting loyalty and trust.
Competitive edge through agility. At ANZ Bank, AI was embedded in fraud detection and customer support, but real advantage came from employees upskilled to understand, trust, and act on AI insights. By demonstrating behaviours like adaptability, critical thinking, and collaboration, teams responded faster to customer needs and mitigated risks effectively turning technology adoption into a tangible strategic advantage.
Risk Mitigation and Ethical Leadership AI-confident employees are trained to spot biases, misuse, and ethical risks. For example, Bank of America invests in programmes that teach staff responsible AI use in financial services. Employee behaviours like accountability, vigilance, and ethical reasoning ensure that AI is applied responsibly, building trust with customers, regulators, and the market.
Stronger organisational resilience During the pandemic, companies with AI-ready talent adapted faster. Unilever, for instance, leveraged AI-driven workforce planning to redeploy staff where demand shifted most. Employees trained to work with AI insights demonstrating adaptability, problem-solving, and proactive decision-making enabled the company to pivot quickly and maintain operational continuity. AI confidence here is as much about behavioural readiness as technological capability.
Ethics and Trust: The Compass for AI Collaboration
Ethics and trust are foundational for AI-readiness and effective Worker-AI coexistence. Organisations must foster behaviours prioritising fairness, transparency and accountability, not just implement technology. The Commonwealth Bank of Australia’s experience illustrates this: plans to cut 45 customer service jobs using AI chatbots were reversed after rising call volumes and union pressure, showing that efficiency cannot override responsibility toward employees and customers. Building these behaviours into everyday workflows is essential for sustainable adoption.
Key considerations for ethical AI adoption:
Embed ethics into behaviour – Implement principles like fairness, privacy, explainability, and security from the start.
Build transparency tools – Explain why AI makes suggestions to foster safety and commitment.
Educate employees – Cover legal and ethical risks, including prompt handling and data privacy.
Proceed gradually – Implement AI thoughtfully rather than rushing replacement.
IBM demonstrates the impact: by training employees in responsible AI use, bias detection, and explainability, the company fosters trust internally and externally, making AI adoption more sustainable and aligned with organisational values while protecting workforce confidence and brand reputation.
Conclusion
AI adoption succeeds when employees embrace it confidently, guided by behavioural competencies like curiosity, collaboration, ethical awareness, and digital confidence. Framing AI as a partner and embedding it into daily workflows fosters trust, experimentation, and proactive problem-solving. Worker-AI coexistence then becomes a driver of innovation, resilience, and sustainable advantage. Organisations that invest in people as much as technology unlock not just efficiency, but a future-ready workforce empowered to lead in an AI-driven world.
The Australian. (2025). Commonwealth Bank’s AI fail exposes more than 45 jobs and sounds a warning for all businesses. https://www.theaustralian.com.au/
Work today isn’t steady or predictable. Roles evolve, skills expire faster, and teams form and reform around shifting priorities. Technology keeps rewriting how we connect, while employees expect more relevance, flexibility, and purpose from their organisations. In such a fluid environment, the real differentiator isn’t just strategy or tools, but whether a company can truly keep pace with how its people work and grow.
The way organisations measure people has come a long way. It started with counting heads and tracking costs, then moved into analysing skills, engagement, and HR processes. Each step gave leaders sharper insights, but the focus had mostly been on outcomes. Did employees meet targets? Did they complete the training? What do performance reviews say? What is the attrition rate? These are valuable, sure. But they’re lagging indicators that tell us what happened, not why, when, or how. The real shift begins when you start asking not just what the numbers show, but how people got there. Did someone overwork to hit a goal, collaborate effectively, or lean on old habits instead of learning?
Hitting a target is the visible part of performance, but the drivers sit beneath the surface. The way people prioritise, solve problems, share knowledge and lean on each other is what shapes the end result. Once you see those patterns, you can shape them too. That’s where behavioural analytics enters the picture – uncovering real-time patterns in engagement, adaptability, collaboration, communication, leadership, and motivation. By paying attention to these signals early, leaders can move from reactive to proactive, using these insights as a springboard for action and growth. That’s potential.
From Manpower to Behaviour
HR analytics has been steadily growing, but most organisations are still at the early stages. The roadmap to analytics started with focus on the number and headcount, evolved to emphasising on engagement and performance and is now slowly transitioning to Behavioural Analytics which is the new order of workforce intelligence.
Manpower Analytics – includes workforce basics focusing on numbers like headcount, attrition, and cost-to-hire. It’s quantitative and operational, ensuring the right number of people at the right place and cost. According to ISG’s 2023 HR Tech Survey, only 36% of companies use predictive analytics in HR, and 43% say they’ve built a data-driven HR culture. Most remain stuck in descriptive reporting.
People Analytics – From manpower analytics, it matures intogoing beyond headcount, to analyse talent, HR processes, and connects with impact on business results, such as quality of hire, engagement, learning effectiveness, succession, and diversity. This is where companies begin predicting rather than just reporting. Deloitte found 70% of organisations were already using people analytics by 2022, with adoption expected to exceed 80% by 2025.
Behavioural Analytics – Today there is a need to take a deeper lookto understand the human layer of work, how employees act, interact, and make decisions. It’s more qualitative, linking behaviour to competencies, culture, and performance. This data often comes from various sources which includes but is not limited to, collaboration tools, surveys, and assessments. Behaviour Analytics and its role in shaping organisation culture is reflected in an example; where a U.S bank adopted a platform called ‘Humanyze’, applied organizational network analysis to understand collaboration dynamics. They found that teams who shared more informal interactions, like overlapping lunch breaks, performed significantly better. By restructuring schedules to encourage this, the bank achieved a 27× return on investment, reduced turnover by 28%, and improved call resolution speed by 23%.
These are small yet significant findings that behavioural analytics can bring to the forefront, bearing a significant impact on key business metrics in a positive manner. The maturity curve is less a steady climb and more a leap. Most organisations are comfortable counting, many are starting to predict, but only a few are bold enough to decode how people truly behave and connect.
Dimensions of Employee Behavioural Analytics
As HR moves from transactional to transformational, behavioural analytics steps in to go beyond basic metrics and answer questions such as:
How are time and effort being invested?
How are people interacting and collaborating?
How are employees pursuing development and feedback?
How are they contributing to shared intelligence?
How do employees feel and sustain performance?
How do leaders inspire, align, and govern responsibly?
These questions anchor six key dimensions of behavioural analytics that bring the human side of organisational performance into focus:
Flow of Work: Captures how employees allocate energy, balance demands, adopt new ways of working, and uphold ethical behaviours – Time usage, adaptability, workload rhythms, ethical compliance
Web of Connections: Reveals the density, diversity, and responsiveness of professional networks – Communication quality, responsiveness, team cohesion, network health
Growth Mindset Signals: Shows proactive behaviours around learning, adapting, and seeking input – Learning behaviours, adaptability, feedback loops, change adoption
Knowledge Capital: Focuses on contribution, documentation, and thought leadership – Knowledge sharing, visibility, innovation contribution
Wellbeing & Sentiment Pulse: Adds the emotional and psychological layer to behavioural data – Emotional state, engagement, recognition, resilience
Leadership & Purpose Dynamics: Captures the clarity of purpose leaders provide, the ethical tone they set, and how effectively they align teams to shared goals and long-term vision – Leadership effectiveness, influence, purpose alignment, trust
Six Dimensional Behavioural Analytics Maturity Framework by Karmine
The Organisational and Employee Value of Behavioural Analytics
Benefits for Organisations
Early Warning Signals for Productivity and Engagement: Instead of waiting for quarterly engagement surveys, organisations can detect issues in real time. Microsoft saw a 16% rise in late-night meetings, 50+ messages sent outside hours, and 20% of staff working weekends. These patterns flagged risks of burnout and workload imbalance, prompting leadership to set clearer boundaries and prevent productivity collapse.
Strengthened Culture and Resilience During Change: Helps organisations spot morale dips and act quickly to protect culture. During an unsolicited takeover attempt, Unilever used automated listening tools and sentiment analysis to track employee engagement and internal communication. This helped detect early signs of falling morale and launch support programs. By acting swiftly, they maintained productivity and workforce resilience. Transparent communication and a strong culture focus enabled Unilever to withstand the takeover pressures and protect employee trust.
Data-Driven Management and Strategies: Instead of relying on assumptions, companies can test which behaviours drive performance and coach managers accordingly. Google’s Project Oxygen proved that effective managers aren’t born, they follow specific, observable behaviours. By analysing more than 10,000 data points, Google identified ten observable & coachable behaviours that reshaped manager training, recognition systems, and even promotion criteria. Within a year, 75% of underperforming managers had improved significantly, leading to stronger team performance, higher engagement, and measurable productivity gains.
Benefits for Employees
Stronger Voice and Sense of Belonging: Empowers employees by ensuring their experiences are heard and acted upon. Mercer launched “Your Voice Matters” initiative after discovering that their staff felt disconnected at work, encouraging encouraged open communication and feedback through regular surveys and focus groups. This raised engagement from 50% to 75% in two years. Employees felt genuinely listened to, which boosted motivation, reduced turnover, built trust and increasing overall productivity.
Smarter Workload Distribution Through Real Insights: Uncovers patterns of overwork or underutilisation, enabling leaders to spread tasks more evenly across teams. Microsoft’s after-hours analysis helped leaders set clearer boundaries and expectations, ensuring teams stayed productive without burning out.
Fairer Development and Growth: When leadership behaviours and performance drivers are grounded in real data, employees benefit from more transparent and fair growth pathways. Google’s Project Oxygen gave employees tangible benefits by vague ideals of “good leadership” to clear coachable actions. Instead of hoping their manager was supportive, employees could expect consistent practices – like regular check-ins, meaningful feedback, and visible support for career growth. This improved trust in leadership and created fairer career paths.
Simply put, behavioural analytics empowers organizations get sharper decision-making, and employees gain a healthier, more supportive workplace.
AI-Powered Employee Behavioural Analytics
AI-powered behavioural analytics is transforming how organisations understand and support their workforce by moving beyond quarterly reviews and annual surveys to real-time insights drawn from collaboration tools, communication channels, and learning systems. Imagine a system that detects a 30% drop in team engagement over two weeks or flags when a top performer’s response time slows by half. AI interprets tone, collaboration patterns, and learning engagement to provide context-rich alerts that allow leaders to act quickly and strategically. The benefits are clear: speed, with instant notifications instead of delayed feedback; context, with cues that highlight root causes rather than raw data; and focus, with precise signals on risks like engagement dips or collaboration breakdowns. As companies adopt these tools, they create more adaptive and personalised workplaces where employees gain tailored career recommendations and learning paths while HR benefits from ethical, explainable analytics that build trust.
Microsoft 365 Copilot is embedded in Teams and Outlook to summarise meetings, detect communication overload, and suggest more efficient collaboration patterns. Similarly, Workday’s AI capabilities analyse sentiment and skills data to provide managers with ethical, explainable insights for talent planning.
Why Behavioural Analytics in HR Is Still Underleveraged
Behavioural analytics has long been used for understanding consumer behaviour. Retail giants, streaming services, digital platforms have refined how they capture customer clicks, preferences, choices, and loyalty. All of this fuel personalisation, retention, and revenue growth. But when it comes to human capital, that kind of behavioural insight remains under-leveraged with the following key challenges holding back adoption:
Privacy, Ethics, and Trust Employees expect far higher privacy and dignity at work than consumers do in markets. Tracking collaboration, keystrokes, or sentiment can easily cross ethical lines without clear consent or transparency. Unlike consumers who trade data for discounts or personalisation, employees value autonomy, fairness, and legal protection.
Fragmented and Inconsistent Data Employee data is scattered across emails, chat logs, meetings, surveys, and HR systems. Only 40% of HR professionals say their organization is ‘good or very good’ at analysing people data, and just 48% rate their data generation capabilities highly. This fragmentation makes insights unreliable and scaling difficult.
Capability and readiness gaps Even when the will is there, most companies lack the systems and skills needed for advanced behavioural analytics compared to digital customer-facing functions. Companies need mature analytics capabilities, reliable data, and sophisticated technology infrastructure. Many are still building maturity in workforce and people analytics before they can dive deeper.
Unclear ROI compared with consumer use cases Marketing analytics delivers clear returns in sales and conversion, but HR outcomes – engagement, collaboration, or well-being – are harder to link directly to financial impact. This makes budget holders hesitant to invest, even though the long-term value is significant.
Until such issues are addressed, behavioural analytics will remain underused in HR, despite its clear potential to strengthen both employee growth and organisational performance.
Building the Foundation for Behavioural Analytics
Behavioural analytics sits at the advanced end of the HR analytics maturity curve. Most organisations begin with descriptive reports, move into diagnostic dashboards, and then step into predictive & prescriptive models. Behavioural analytics relies on multiple layers of technology, data and culture being in place.
Laying the Foundation for Behvioural Analytics
Ethical Considerations: Watchful but Respectful
Here’s where a bit of nuance matters. Behavioural analytics only works if emSample metrics for 6-dimension behavioural analytics pyramid across maturity levelsSample metrics for 6-dimension behavioural analytics pyramid across maturity levelsployees trust it. Done openly, it strengthens collaboration, development, and opportunity. Done poorly, it risks undermining culture. The goal should always be support, not surveillance. Here are ethical considerations that companies should apply:
Transparency: Clearly explain what data is collected and why. Position it as development-focused, not surveillance
Privacy: Use aggregate or anonymised data where possible. If individual behaviour is analysed, do so with consent and for growth, not punishment.
Opt-In Choices: Make participation voluntary where you can, with clear benefits such as tailored support.
Empathy-Driven Use: Interpret behaviour data with context – late responses may reflect deep work or personal matters, not disengagement. Data should start conversation, not drive judgement.
Clear Boundaries: Define what will not be measured (e.g., private chats, personal devices) to build trust.
Shared Value: Show how insights help employees grow in their careers and learning, not just how they benefit the organisation.
Human Oversight: Algorithms can flag patterns, but people should interpret and act with care
Feedback Loops: Give employees a voice to question or clarify how their data is read, making it a two-way process.
Cultural Sensitivity: Behaviours vary by culture and role; avoid one-size-fits-all interpretations.
Positive Reinforcement: Use analytics to encourage constructive behaviours, not just detect risks.
Linking Behavioural Analytics to Learning & Development
Behavioural analytics provides a data-driven foundation for modern L&D. By measuring signals such as collaboration patterns, feedback-seeking, or adaptability to change, organisations can identify the precise learning needs that hold teams back. Instead of rolling out generic programs, analytics enables the sharper and personalized learning journeys across technical skills, soft skills, leadership development, or competency training.
This enables employees to engage with learning that feels relevant to their roles, while leaders can track measurable progress through the same behavioural indicators that highlighted the need. This creates a closed loop between insight and action – analytics identifies gaps, L&D addresses them, and follow-up analytics measures the impact. Done well, this approach not only builds stronger skills but also nurtures a culture of continuous learning, adaptability, and high performance.
Conclusion
Behavioural analytics is moving fast to becoming a core part of how organisations understand and support their people by using real behavioural signals to shape smarter learning, more relevant development, and stronger team performance. The real win is that it helps HR step out of the back office and drive resilience, adaptability, and culture at scale. And with AI in the mix, the future goes further than just analysing behaviour, by simulating outcomes, personalising growth, and creating workplaces that continuously learn and improve. It is not just a tool, it is the next frontier in data-driven talent intelligence that provides strategic, corporate-focused insights
References
Deloitte. (2023). Global Human Capital Trends 2023 Report. Deloitte Insights.
Deloitte. (2025). Global Human Capital Trends 2025 Report. Deloitte Insights.
ISG. (2023). Survey on Industry Trends in HR Technology and Service Delivery 2023. ISG Research.
Bersin, J. (2018). People Analytics Maturity Model. Bersin by Deloitte
George, W. W., & Migdal, A. (2017). Battle for the Soul of Capitalism: Unilever and the $143 Billion Takeover Bid. Harvard Business School Case 317-127.
In the world of constant uncertainty, skills are becoming obsolete at unprecedented rates, employees are getting burnt out, disengaged, or disconnected. Traditional resources like compensation, perks, or well-being programs are not enough. So how do organisations build a workforce that’s adaptive, engaged, and future-ready?
A workforce that doesn’t just cope but thrives? The answer isn’t more skills or smarter systems, but stronger inner foundations. The key is to build Psychological Capital (PsyCap) by empowering Internal Employee HEROs. For organisations, PsyCap is a behavioural asset that enhances how people think, feel, and act at work.
Psychological Capital ‘HERO’ Model
The HERO Model, conceptualised by Luthans, Youssef, and Avolio in 2007 serves as an extension of positive organisational behaviour, comprising of four key elements:
Key Elements of the HERO Model
The HERO elements independently contribute to workplace effectiveness. Together, they multiply into a powerful psychological engine that fuels proactive behaviour and adaptive performance.
Organisational Payoff of Building Psychological Capital
Organisations that invest in building PsyCap look for more than just morale boosts, they aim to influence productivity, engagement, and performance, yielding strategic returns.
Direct Impact on Performance and Productivity: Higher PsyCap is significantly correlated with job performance and job satisfaction. This translates into employees who not only deliver more consistent results, but also take greater ownership of their work, adapt faster to change, and sustain high output even in challenging conditions. Organisations that invest in building PsyCap, have shown productivity increases of up to 20%.
Google’s Employee Mindfulness Program includes tools such as guided meditation, apps and workshops, all integrated into its culture to boost employee well-being, focus, and resilience. The offering helps employees manage stress and improve emotional regulation. This positively impacts organisational performance by fostering a more engaged, adaptive, and productive workforce, reducing burnout, and supporting sustained innovation.
Enhanced Employee Engagement and Retention: Employees high in PsyCap tend to be more emotionally invested in their organisations, less likely to burn out, and more likely to stay and thrive, highlighting how inner psychological resources can stabilise employee retention under pressure. Organisations that invest in positive organisational behaviour, including PsyCap, have shown retention improvements of 25%.
Salesforce’s “Ohana Culture” includes mental health and wellness programs, resilience-building workshops, and opportunities for employees to contribute to social impact work. This fosters a sense of purpose and hope among its workforce. Salesforce focuses on family, trust, and community, creating a supportive work environment, and emphasized high levels of job satisfaction among employees. Creating a positive work environment and strong sense of community contributed to low turnover rates, helping Salesforce retain top talent
Business Outcomes that Compound Over Time: Companies that cultivate PsyCap report improved customer satisfaction, innovation rates, and operational efficiency. It is proven that organisations implementing targeted PsyCap interventions saw performance improvements of 2-3% which, when applied to large workforces, represented millions of dollars in productivity gains.
Microsoft’s leadership encourages a growth mindset that embraces learning from failure and continuous development. The approach enhances individual capabilities and drives team collaboration, creativity, fuelling innovation. Over time, these cumulative improvements lead to stronger business outcomes – higher productivity, sustained competitive advantage, and accelerated innovation – that compound, positioning Microsoft for long-term success in a fast-evolving technology landscape.
Resilience as a Strategic Risk Buffer: Resilient employees form the backbone of crisis-readiness. High PsyCap teams recover faster from setbacks, collaborate effectively under pressure, and are more likely to find creative solutions instead of defaulting to risk-aversion techniques. This behavioural agility reduces downtime and accelerates recovery from disruptions.
IBM emphasizes building employee resilience and self-efficacy through wellness programs and leadership training focused on emotional intelligence and adaptability, equipping employees with tools to take ownership of their career growth and maintain optimism in the face of challenges. Leadership programs that enhance self-awareness further reinforce personal resilience, enabling leaders and teams to navigate uncertainty more effectively. This focus on resilience acts as a strategic risk buffer for IBM, reducing the impact of workplace stressors and disruptions while sustaining productivity and long-term organizational stability.
Culture and Reputation Dividend: Intentional modelling of PsyCap leads to reduced change resistance, shortening transformation timelines, influencing organisational culture. An optimistic, hopeful, and confident workforce not only drives results internally but also signals to customers, investors, and prospective hires that the company is forward-thinking and people-centric.
Ben & Jerry’s commitment to building empathy and compassion in its workforce through values-based hiring and culture-building efforts aligned with its social and environmental mission. This strong culture enhances internal collaboration and morale and also boosts their reputation as a purpose-driven brand, creating a significant culture and reputation dividend that attracts customers, talent, and partners who share these values.
Building the Foundations of a High-PsyCap Culture
Go Beyond Wellbeing by Embedding PsyCap into Organisational DNA: Most employee wellness programs today are reactive and step in only after burnout, attrition, or disengagement have already happened. PsyCap offers a proactive mindset shift that helps build the mental and emotional infrastructure needed for sustainable engagement, empowering individuals to become self-renewing assets who regulate stress, adapt quickly and maintain a solution-oriented mindset.
How can this be applied:
Performance reviews can include focus on how employees demonstrated persistence in setbacks, optimism in uncertain conditions, or creative problem-solving under pressure.
Leaders must strive to consistently model these traits in their own conduct, publicly sharing how they navigate challenges to make them aspirational and normalised across the workforce.
Deconstructing into Observable Daily Habits: The key to making PsyCap truly impactful lies in consistency – small, observable micro-behaviours practiced daily – how conflict is resolved, how failure is treated, how listening happens. These micro-habits are easy to apply, stack onto existing routines, and create repeatable patterns that build long-term behavioural change.
How can this be applied:
You don’t train efficacy – you train the micro-behaviours of efficacy.
Starting meetings with a clear plan, summarising and sharing learnings after completing a task, actively seeking peer input on work in progress, and volunteering for small stretch assignments that push skills beyond current comfort zones.
Equip Leaders and Managers as PsyCap Multipliers: Leaders and Managers are the primary translators of organisational intent into daily employee experience. By equipping them with targeted training on coaching conversations, cognitive reframing techniques, and resilience storytelling, companies turn them into catalysts for PsyCap development. Managers must model behaviours to signal their importance, and feedback should focus on behaviours, not just outcomes
How can this be applied:
Managers can be taught how to help team members visualise success, break daunting challenges into manageable steps, and identify resources that increase their likelihood of success.
Regular manager roundtables or peer coaching circles can help them share what works, troubleshoot roadblocks, and stay aligned in reinforcing PsyCap behaviours.
Performance & Learning Systems that Reward PsyCap Behaviours: Integrating recognition for PsyCap behaviours into performance & learning systems means moving beyond measuring only outcomes to valuing the underlying mindsets and actions that drive sustainable success. This combined approach of incorporating competencies into performance and learning systems, organisations can emphasize on the importance of ‘how’ results are achieved and create a continuous loop of reinforcement and skill-building.
How can this be applied:
By embedding markers for persistence, learning agility, solution-oriented thinking, and collaborative problem-solving into performance reviews, peer-feedback platforms and real-time recognition tools
Learning programs can be designed to develop these traits through workshops, simulations, and on-the-job projects, while performance and recognition systems validate and reward their application.
Managers can consistently highlight these traits in feedback discussions and link them to career progression, bonuses, or development opportunities.
Feedback Loops & Storytelling: Feedback loops and storytelling can be powerful levers for building PsyCap when they move beyond standard performance reviews to become an ongoing exchange of insights, recognition, and shared experiences. These stories, when told authentically and linked to the organisation’s values, make abstract competencies tangible and aspirational, showing peers how PsyCap works in practice.
How can this be applied:
Organisations can intentionally capture real employee stories, instances where HERO helped navigate challenges, and share them through team huddles, internal newsletters, learning sessions, or digital platforms.
Timely, constructive feedback that reinforces desired behaviours and celebrates small wins.
From HERO to Habit: Behavioural Competencies as the True Capital
The true strength of positive PsyCap is exhibited through individual behavioural competencies. Self-awareness, emotional regulation, resilience, active listening, conflict handling, assertiveness are core capabilities that shape how people work, lead, and grow. Teams with higher PsyCap are more collaborative, creative, and resilient to change, leading to faster decision cycles and better problem-solving under pressure. Embedding specific behavioural competencies into job roles, leadership, and feedback systems can amplify PsyCap organically creating a scalable, culture-wide impact.
Source: WEF Future of Jobs Report 2025
Behavioural competencies are now as vital as technical skills. The WEF Future of Jobs Report 2025 highlights critical human skills like analytical thinking, creative thinking, resilience, flexibility, agility, curiosity, lifelong learning, leadership and social influence as among the fastest-growing capabilities needed through 2030. These competencies are strategic differentiators that, when rooted early in career, can turn potential into progress compounding into a long-term competitive advantage for both employees and organisations.
Key Behavioural Competencies for an Evolving Workforce
While the modern workplace demands a wide range of human capabilities, below are foundational competencies that drive meaningful performance and growth.
Self-Awareness – It is the ability to consciously recognise, understand, and reflect on your own thoughts, emotions, motives, values, and behaviours — and how they affect both yourself and others. Self-aware employees make better decisions, communicate more effectively, are more promotable and coachable. According to research by Tasha Eurich (2018), only 10–15% of people are truly self-aware, despite 95% thinking they are. When cultivated early self-awareness becomes the bedrock of personal and professional development.
Emotional Regulation: It focuses on the constructive management of emotions in real time. It is what allows a person to stay composed in conflict, navigate stress productively, and avoid reactive behaviour. This competency is crucial in high-pressure situations like appraisals, leadership roles, or navigating ambiguity. For leaders, it supports presence, patience, and clarity in crisis.
Resilience: Resilience is about bouncing back from setbacks and bouncing forward with learning. Resilience involves flexible problem-solving, reframing adversity, and regulating negative self-talk. Unlike ‘grit’ which sometimes can romanticise endurance, resilience includes flexibility, emotional agility and social support. According to a study in the Journal of Occupational and Environmental Medicine, individuals with higher resilience experienced 10 – 20% lower rates of absence, depression, and productivity loss, including in high stress environments compared to those with lower resilience. Teams with high resilience collective scores respond faster to disruption and require less emotional labour from managers during uncertainty.
Constructive Communication: Constructive communication is a combination of what we say, how we say it, and the way we interpret others’ words. It holds teams together, the bridges the gap between leadership and employees and is the catalyst for productivity and innovation. It fosters clarity, boosts morale, minimises misunderstandings – creating a sense of belonging and engagement, and driving sustained success. It focuses on how to ask questions, offer or receive feedback, resolve tensions without avoidance, speak with clarity and respect, actively listen with empathy.
Behavioural Competencies as Catalysts for Career Milestones
In every stage of the career, it’s the right mix of mindset and skill that drives progress. These competencies show how we turn individual strengths into collective success.
Impact on employees across layers in the organisation
Conclusion
In the rush to automate, upskill, and optimize, companies often overlook their most renewable resource: the human potential. PsyCap reminds us that ‘being more’ is often more powerful than ‘doing more’. The real differentiator isn’t just skill, it is behavioural fluency – the ability to regulate, adapt, empathise, and communicate across situations and stages – with which employees become self-renewing contributors to organisational growth.
When organisations invest in HEROs from the beginning of employee’s career journey, the return isn’t just financial; it is cultural, human, and long lasting. With structured development around awareness, communication, and resilience, employers create a feedback loop of confidence, competence, and clarity. Think of it as compound interest, just as starting early to save yields exponential returns, starting to build behavioural agility early creates career-long ROI.
It is time to treat behavioural competencies as the foundation of every successful, sustainable organisation and not as afterthoughts. With 59% of global workers needing reskilling by 2030 and employers planning significant investment in workforce transformation, there’s an opportunity to embed behavioural development from entry-level through the executive suite which will produce not just high performers – but Human Advantage: adaptable, engaged, collaborative, and future-ready.
Sources
Luthans, F., Youssef, C. M., & Avolio, B. J. (2007). Psychological Capital: Developing the Human Competitive Edge. Oxford University Press.
Eurich, T. (2018). What Self-Awareness Really Is (and How to Cultivate It). Harvard Business Review.
Walumbwa, F. O., Luthans, F., Avey, J. B., & Oke, A. (2009). Authentically leading groups: The mediating role of collective psychological capital. Journal of Organizational Behavior, 30(3), 377–396.
Avey, J. B., Reichard, R. J., Luthans, F., & Mhatre, K. H. (2011). Meta-analysis of the impact of positive psychological capital on employee attitudes, behaviors, and performance. Human Resource Development Quarterly, 22(2), 127–152
Luthans, F., Avey, J. B., & Patera, J. L. (2008). Experimental analysis of a web-based training intervention to develop positive psychological capital. Academy of Management Learning & Education, 7(2), 209–221
Shatté A, Perlman A, Smith B, Lynch WD. The Positive Effect of Resilience on Stress and Business Outcomes in Difficult Work Environments. Journal of Occupational and Environmental Medicine. 2017 Feb
Journal of Occupational and Environmental Medicine. (2010). The relationship between resilience and workplace outcomes in a large sample of employees. Journal of Occupational and Environmental Medicine, 52(7), 698–706.
Dr Shabana Azami, “Fostering Employee Engagement and Retention through Ohana Culture: A Case Study of Salesforce”, Kronika Journal(Issn No-0023:4923) Volume 24 Issue 7 2024
In summer 2025, two seemingly unrelated cyber incidents made headlines. In the United States, insurance giant Allianz Life revealed a personal data breach affecting its 1.4 million American customers. Days later, Indian police raided a fake “Microsoft Support” call center in Noida, arresting 18 people for an international tech support scam that had duped unwitting victims (primarily in the U.S.) out of thousands of dollars.
Though vastly different, one, a high-tech data heist targeting a major corporation, the other a low-tech con targeting everyday computer user – both underscore a new age of cybercrime that is blurring the lines between corporate security threats and consumer fraud. The common thread: cybercriminals are exploiting trust at every level.
In this part, we unpack both cases and analyze what they reveal about today’s cyber threat landscape. We’ll explore what cybersecurity means for mid-sized companies, how leaders can strengthen defenses, protect customers, and their reputations in the face of these modern threats.
The Allianz Data Breach – A Corporate Wake-Up Call
On July 16, 2025, Allianz Life Insurance Company fell victim to a cyber breach via social engineering. The attackers tricked access to a third-party cloud-based Customer Relationship Management (CRM) system, proving once again that the human element is often the weakest link in security.
Once inside the CRM, the intruders were able to steal personally identifiable information (PII) related to the majority of Allianz Life’s 1.4 million U.S. customers, along with financial professionals and employees. The Company discovered the incident one day after it occurred and notified authorities by July 25, 2025, with informing affected consumers by August 1.
All signs point to a known hacking group leveraging voice-phishing (vishing) tactics. In fact, just a month prior, Google had warned about a ransomware group (tracked as UNC6040, informally known as “The Com”) that specializes in vishing campaigns aimed at compromising organizations’ CRM instances for large-scale data theft and extortion. One infamous subset of this group, Scattered Spider, had even breached Australia’s Qantas Airways via a third-party platform using similar social engineering tricks.
Investigators suspect this same group may be behind the Allianz breach. If true, beyond the immediate breach, the Company could be drawn into a ransom negotiation under the gun of public data exposure.
This incident is a lesson that cybersecurity isn’t just about firewalls and encryption alone but equally about people and third-party risks. The breach also illustrates how cybercriminal groups today arewell-organized and research-driven, going after high-value cloud platforms that aggregate massive troves of data. The fallout for Allianz will likely include costly notifications, possible regulatory fines, and damage to customer trust,a cautionary tale for any business handling sensitive data.
The Fake Tech Support Scam- Trust Exploited at Scale
In Noida, India, posing as “Microsoft technical support”, a group of fraudsters ran a tech support scam targeting mostly U.S. victims. The scammers acquired contact information through associates in America. For six months, they used phishing emails as warning recipients of a supposed bug or virus in their system and urged them to contact the provided tech support immediately.
The victims were redirected (via VoIP) to the fake call center where the fraudsters, posing as Microsoft experts, walked the victims through installing a remote-access tool on their PC, under the pretense of helping diagnose the issue. With remote access, the scammers deployed malware and fake warning prompts.
The victims were coerced into purchasing “security software” or support packages, costing between $250 – $5,000, to “fix” nonexistent problems. Payment was accepted via Zelle money transfer or cryptocurrency, making it harder to trace. Once the money was transferred, some were left with actual malware for future exploitation.
This isn’t one-off, FBI ranks tech support scams as the third costliest U.S. cybercrime in 2024, totaling $1.46 billion. It’s striking how organized and large-scale they have become. For businesses, it’s a stark reminder thatfraudsters may exploit your brand to harm your customers or breach your systems through unwitting employees.
Modern Cybercrime Landscape: Key Traits of the New Age
These two case studies raise the question: What are the defining traits of the new age of cybercrime era that businesses need to grasp?
Social Engineering at Scale
Both attacks succeeded by tricking humans, not systems. Whether it was phishing, vishing, or phone scams, social engineering is at the core. Mid-sized businesses are often deluged by such attacks with their employees 350% more likely to be targeted than those at larger enterprises.
Cybercrime-as-a-Service
Today’s cybercriminals operate like enterprise organizations. Groups like Scattered Spider/The Com run specialized operations with defined roles; or scams like Noida’s fraud call center business with managers, employees, scripts, and a supply chain for victim leads. A booming “crime-as-a-service” ecosystem allows cybercrime to scale dramatically.
Extortion and Multi-Faceted Attacks
Cybercriminals are combining tactics such as malware, fraud, data theft, and extortion to maximize their payoff. Many ransomware attacks today also steal data before encrypting systems, creating a double jeopardy scenario (pay to unlock your files and pay to prevent a leak). Even pure data breaches like Allianz’s case often segue into ransom demands.
On the flip side, fraud operations like the tech support scam show how attackers focus on financial extortion of individuals, but could just as easily deploy malware during those interactions to enable further crimes. Businesses must be prepared multi layered fallout: data privacy issues, financial losses, and reputation damage.
Global and Cross-Border in Nature
Cybercrime is now borderless. The Noida call center scam targeted Americans from India; the data breach of a German-based insurer’s US subsidiary may involve global actors. Law enforcement’s jurisdictional limits often play to the attackers’ advantage. However, global cooperation is improving. Business leaders are recognizing the scale of such operations and adjust their threat models for actors beyond traditional profiles.
Third-Party and Supply Chain Vulnerabilities
Often, breaches begin through a compromised third-party environment that potentially has weaker security or accessible credentials.. Mid-sized firms, who often rely on third-party cloud services or managed IT providers, need to scrutinize those partners’ security postures and have contingency plans if a vendor is compromised.
These trends mean that assuming you’re too insignificant to be targeted is a dangerous myth. The next section looks at why that mindset must change and how organizations can respond.
Implications: Why No One Gets a Free Pass
In summary, mid-sized businesses are prime targets for cybercriminals.Valuable yet often vulnerable. Leadership must treat cybersecurity as a core business risk, not just an IT issue. Assuming “it won’t happen to us” is a costly mistake. The good news is that with the right approach and prudent investments, even resource-constrained organizations can significantly reduce their risk.
Building a Cybersecurity Shield: Frameworks and Strategies for Mid-Sized Firms
Businesses can take concrete steps to build a robust cybersecurity posture, drawing on established frameworks and best practices. Here are key strategies and considerations:
Adopt a Security Framework for Structure:
Leverage well-known frameworks such as NIST Cybersecurity Framework with its five core functions – Identify, Protect, Detect, Respond, and Recover. This means identifying key assets and risks, safeguarding them, detecting threats early, responding effectively, and recovering quickly. Frameworks like the CIS Critical Security Controls or ISO 27001 can also be adapted to a smaller enterprise. Depending on the nature of business and the extent of cyber security threat an organization might be exposed to, a robust cyber security policy becomes a baseline.
Foster a Human Firewall (Security Awareness)
Technology alone won’t stop social engineering. It’s crucial to train employees regularly about phishing, suspicious calls, and scams and promote a culture where employees can report potential threats without fear and think twice before clicking or sharing sensitive info. Many breaches can be thwarted by an alert staff for instance, an employee who questions a strange request and alerts IT could thwart a BEC scam. People, once they turn into a “human firewall”, are the first & often best line of defense.
Secure Your Technology and Third Parties
Go beyond basics andfocus on:
Vulnerability management – Keep your systems, especially internet-facing ones, patched and updated. Many attacks exploit unpatched software or weak remote access settings.
Third-party risk management – Assess the security of the software and vendors you use. If you entrust customer data to a cloud CRM or rely on an outsourced IT provider, scrutinize their security practices, data encryption and breach history. Prepare contingency plans in case of vendor breaches with information about log audits, access management, data management; and include supply chain risk as part of your security strategy.
Implement Multi-Factor and Zero Trust Principles: Enable multi-factor authentication (MFA) across critical accounts and systems like email, VPNs, banking portals, and admin logins. Adopt a Zero Trust security model which means never automatically trusting any connection or user, even if they are inside your network. Verify explicitly, enforce identity checks, limit access, monitor behaviour, and segment systems to minimize damage if compromised. For example, don’t give any single user broad access to all data; segment your network and data so that if one account is compromised, the attacker can’t roam freely.
Incident Response and Backup: It’s wise to assume that an incident will happen. Prepare an incident response plan by creating an internal response team with clear roles, emergency contacts list (law enforcement, cyber insurance, IT forensics, etc.), and practice drills. Maintain reliable, offline and offsite data backups and test them. Ensure you have business continuity plans in case your primary systems go down – perhaps by reverting to manual processes or via secondary systems temporarily. Also, know your legal and compliance obligations: if customer data is stolen, you may need to notify within a certain timeframe.
Leverage External Expertise and Tools: Mid-sized organizations may lack internal resources, but can leverage outside resources to boost security.
As sophisticated as “cybercrime 2.0” has become, many incidents still boil down to exploiting basic weaknesses. By mastering the fundamentals and building strong defenses, mid-sized businesses can drastically improve their resilience against cyber threats. With a consistent and multilayered strategy with vigilant sentries (your people and monitoring systems), you stand a much better chance of detecting and thwarting attackers.
Conclusion
The tales of the Allianz data breach and the Noida tech support scam illuminate two sides of the new age of cybercrime where both high-tech and low-tech tactics thrive. For mid-sized businesses, these are not distant threats, they are warnings. .
There’s a silver lining, it’s that awareness is growing, and tools and knowledge to fight back are more accessible than ever. Law enforcements across borders are cooperating to take down criminal networks. By applying the right frameworks and investing in people and process (not just technology), mid-sized firms can level the playing field despite attackers’ advantages. Think of cybersecurity as an investment in your company’s longevity and trustworthiness.
The fight against cybercrime is now a permanent fixture of doing business in the digital age. The threats will continue to evolve – tomorrow it might be an AI-driven phishing attack or a deepfake voice message from “your CEO” asking for a funds transfer. But the core defense remains the same: knowledge, preparedness, and agility. The companies that endure will treat security as a continuous journey, not a one-time fix. The new age of cybercrime is upon us, but with resilience and foresight, we can ensure it’s an age of cyber vigilance for the defenders as well.
Mid-sized listed companies often continue to rely on the same legacy systems that once supported their early growth. Over time, however, these aging platforms become a burden. Excessive customizations and patchwork integrations accumulate into ‘tech bloat’, a complex tangle of outdated software and add-ons that slow the business down.
One analysis noted that redundant systems could inflate operating costs by 20% and delay decision-making by 30% due to fragmented data. These hidden costs accumulate over time, eroding competitiveness.
This article explores how legacy systems and ERP customizations constrain mid-sized firms drawing on examples from manufacturing and financial services, and why adopting nimble, easily orchestrated tools is the way forward. We also outline how companies can transition from legacy baggage to a future-proof tech stack.
The Weight of Legacy: How Tech Bloat Occurs
Tech bloat refers to the proliferation of redundant or antiquated technologies within an organization’s IT landscape. Companies in growth stage often over-customize their enterprise software to meet unique needs, especially when newer, scalable solutions seem unwarranted or too costly. Over years though, these ad-hoc adaptations create what is typically a clutter around the system.
Common symptoms of tech bloat include outdated processes, redundant / overlapping applications or modules (often kept “just in case”) that duplicate functions, fragmented data and a company culture clinging to familiarity which only reinforces the cycle. Individually, each workaround or customization may have solved a short-term problem. But collectively, they begin to form a convoluted junction of systems that is hard to maintain or scale.
For example, many mid-sized manufacturers still run on legacy ERP or production management systems implemented more than a decade ago. These might handle core functions like inventory or basic scheduling, but they struggle to support Industry 4.0 initiatives such as IoT-enabled machines, advanced analytics, or AI-driven automation.
When legacy software can’t easily interface with sensors on the shop floor or can’t process the volume of real-time data modern equipment produces, it becomes a bottleneck.
Data Quality and Integration Constraints
A major pain point tied to legacy systems is poor data quality and integration. Older systems were not designed with modern data needs in mind. Information gets trapped in silos, and companies struggle to obtain a “single source of truth” across functions.
Data might be incomplete, inconsistent, or not available in real time, undermining both strategic and day-to-day decisions. In fact, reliance on outdated legacy systems itself is listed as a common cause of data integrity problems. Older platforms often lack features to ensure data quality, and integrating them with modern applications can introduce inconsistencies. Analytics thus often remains unsupported due to quality constraints.
Customizations layered on top of baseline systems further complicate data flows. Often, quick fixes or departmental databases are introduced to compensate for what the main ERP cannot do. For instance, finance might maintain a separate spreadsheet model because the legacy ERP’s reporting isn’t flexible enough, or a manufacturing plant might have a standalone quality tracking system not fully integrated with the core production software.
These patches create data orchestration challenges and it becomes difficult to aggregate and reconcile information across the enterprise. Without large IT teams, such integration gaps are sometimes bridged with manual work, which introduces opportunities for inefficiencies.
Many mid-sized banks and insurers grew on top of legacy core systems and have since layered on digital products without modernizing the core. This has led to situations of struggles of data integration which isn’t just an IT headache; but often a serious compliance liability.
Migration of data from legacy systems is often a great challenge. Product design in legacy systems capture data in different formats that don’t support easy migration to the new systems.
Industry-wide, banks lost an estimated $485.6 billion to fraud in 2023, much of it due to increasingly sophisticated schemes that exploit any lag in oversight. For mid-sized institutions with tight margins, such losses along with potential regulatory penalties for late reporting can be devastating. As a 2025 banking technology report highlights, outdated batch-based systems leave customers waiting for yesterday’s information and give fraud a head start – “a liability no mid-sized bank can afford in the instant economy”.
From a risk management perspective, the key is to recognize tech bloat as an enterprise risk, not just an IT problem. It should be raised in risk registers and board discussions, the same way one would discuss financial, operational, or market risks. Once understood, the mitigation is to modernize and streamline the tech environment deliberately and proactively, before a crisis forces the issue.
Transitioning to a Future-Proof Tech Stack – Key Pillars
The good news is that today there are more options than ever to right-size a tech stack for scalability, flexibility, and integration. A “future-proof” tech stack for a mid-sized firm would typically have the following characteristics:
A. Modular Architecture
Instead of one monolithic system doing most things, the stack is composed of smaller, specialized applications or services that can be connected. This could mean using a core ERP for finance and inventory, but a separate best-of-breed system for, say, CRM or e-commerce, with seamless integration between them. The benefit is greater flexibility to upgrade or swap out one component without a full upheaval and usually better functional depth in each area.
B. Ease of Integration
A nimble tech stack is one where data can flow readily across systems. Modern tools achieve this with API-driven designs and integration middleware. The ability to orchestrate workflows that span multiple applications would be crucial. For example, an order entry in the CRM should automatically create a demand signal in the manufacturing system and an invoice in the finance system, without manual intervention.
Scalability and Cloud Infrastructure: To enable ease of scale, many mid-sized enterprises are migrating from on-premises servers to cloud-based solutions. Cloud infrastructure (whether public cloud or private/hybrid clouds) offers on-demand scalability to can ramp up capacity during peak periods or as the business grows, without having to overhaul hardware. Cloud-based SaaS applications also relieve the burden of software patching and upgrades, as the vendor handles that. New market entrants often go cloud-native from the start, building on scalable platforms to “avoid vendor lock-in and technical bloat”
C. Security and Compliance by Design
Modern systems tend to have stronger security frameworks and compliance features out-of-the-box. A good tech stack will include up-to-date identity and access management, encryption of data in transit and at rest, audit logging, and compliance modules for relevant regulations (be it GDPR for data privacy or SOX controls for financial systems).
Today’s products also have external stakeholder portals that allow for limited access but enable the consolidation of data from all sources in one place such as a customer portal, Vendor Portal or a Partner Portal.
Leading practices to ensure clinical transition
Transitioning from legacy to future oriented systems is a journey that involves careful planning and execution. Here are some leading practices for mid-sized firms embarking on this journey:
1. Audit and Rationalize
Start with a ruthless audit of your current IT landscape. Inventory all systems, custom scripts, and data stores. Identify which ones are redundant, outdated, or low-value. It’s common to find multiple tools performing similar functions (for example, two reporting tools being used by different departments).
Evaluate which systems are truly critical vs. which could be phased out or consolidated. This process often uncovers “quick wins,” such as shutting down an old server or eliminating duplicate software licenses to save cost. More importantly, it gives you a map of dependencies highlighting where fragile integrations might break during modernization.
An independent technology assessment explores the audit of inventory and provides a comprehensive priority order and roadmap for implementation.
2. Prioritize Incremental Modernization
Prioritize areas where modernization yields the highest benefit and manageable risk. This could mean decoupling a piece of the monolith into a microservice or selecting one function (say, CRM or HR management) to migrate to a modern SaaS first.
By adopting microservices or a two-speed architecture, you can gradually migrate workloads to newer systems while keeping the business running on the old system in parallel.
Many companies start with less critical modules as pilots, learn from those migrations, and then tackle core systems. Re-architect in steps by carving out modules from the legacy core and rebuilding them.
3. Strengthen Data Foundation
As part of the transition, invest in data cleansing and integration early. It’s futile to implement a shiny new platform on top of dirty or siloed data. Growing firms should consider setting up a central data repository or using data integration tools to pull together key information from legacy systems.
This could run in parallel to legacy systems initially, for example, building a cloud data warehouse that aggregates data from the old ERP, CRM, and other sources. Such a project not only improves reporting in the short term, but also prepares the ground for new systems (which can plug into the centralized data store).
Ensuring data integrity and consistency will make the eventual cut-over to new applications much smoother. Additionally, define data governance practices so that as new systems come online, they adhere to common data standards and quality checks.
4. Foster a Culture of Change and Upskilling
One often underestimated aspect of modernization is the human factor. Employees comfortable with legacy tools may resist the change or fear that new systems will complicate their jobs.
This could be tackled by communicating the vision for the new system, involving end-users in design and testing, and providing robust training. Organizations could also consider encouraging a culture that rewards innovation, perhaps by running internal hackathons or pilot programs to get teams excited about new ways of working.
At the same time, an aspect to consider is addressing the skills gap. Need to upskill staff or hire new talent fluent in modern architectures could be imperative. Bringing in a “digital native” leader or two can also help drive the transformation from within. A robust change management framework aids such transitions in a holistic manner.
By following these steps, growing companies can navigate the modernization journey in a controlled, risk-aware manner. The key is to view tech stack improvement as an ongoing program rather than a one-off project. The external environment, from cyber threats to compliance requirements will continue evolving, so building an adaptable technology core is itself a risk management strategy.
Conclusion
Whether it’s adopting a modular ERP approach, leveraging cloud services, or deploying integration platforms, mid-sized firms have pathways to shed legacy detritus and become more data-driven and responsive. The transition needs to be handled with care though. With incremental steps, solid change management, and an eye on risk mitigation it is very much achievable.
Those that act decisively now, auditing their systems and steadily modernizing, will not only reduce the risks of today but also position themselves to capture the opportunities of tomorrow. The time to break free from the constraints of legacy tech bloat is now. Future growth and resilience depend on it.
Sources:
Graham, Paul (2025). Beyond Technical Debt: Overcoming The Burden of Legacy Systems (LinkedIn).
backbase.com Pleiter, Jouk (2023). Legacy banking tech is a dead-end. Here’s why progressive modernization is the way forward. (Backbase Blog).
erpadvisorsgroup.com ERP Advisors Group (2023). ERP Implementation Case Study Series: Mid-Sized Food & Beverage Companies.
ibm.com IBM (2023). Data Integrity Issues: Examples, Impact, and 5 Preventive Measures.
whatfix.com Whatfix (2025). 9 Critical Digital Transformation Challenges to Overcome.
ESG has officially entered the mid-market boardroom. Sustainability sections now feature prominently in annual reports. Mid-sized companies display framework badges with pride such as GRI, TCFD, and SASB, and fill pages with metrics, values, and diagrams tracing their impact across the value chain.
What many mid-sized firms have built however, is ESG optics, not ESG integration. ESG continues to largely operate as a standalone disclosure compliance driven function, decoupled from Enterprise Risk Management (ERM), and operational decision making.
The cost of this structural disconnect is rising. Investors are demanding alignment between ESG strategy and business outcomes. Operational incidents are increasingly linked to blind spots that ESG frameworks were supposed to surface but didn’t.
This article examines the widening gap between ESG reporting and ESG risk integration in mid-sized firms. When it refers to ESG risks, it points to a broad but tangible spectrum of exposures. These include climate transition shocks, biodiversity loss, labour rights violations, greenwashing, data breaches, supply chain vulnerabilities, and governance failures. These are not theoretical risks. They show up as project delays, litigation, regulatory penalties, capital constraints, and reputational damage. For mid-sized firms, exposure is growing, but the ability to anticipate, measure, and mitigate ESG risks often falls short. This article explores that disconnect and lays out a blueprint for embedding ESG into the core of ERM, where it belongs.
Where Integration Breaks: Key Vulnerabilities
a. Scattered Ownership, Hollow Oversight
This diffusion is often a legacy of how ESG has evolved in resource constrained settings. Without dedicated teams, ESG has tended to land where bandwidth exists at a point in time, not where strategic alignment lies.
Ask who is accountable, and the answers are often unclear or contradictory. CSR may manage community initiatives, risk taking on climate, legal handling disclosures, and HR overseeing diversity. Responsibilities are thus scatteredwith little coordination between units.
When issues emerge, responses are disjointed. A vendor may face human rights violations or a site may breach environmental norms, but coordination falters. In such moments, governance gaps surface.
The result is symbolic oversight where updates are shared, dashboards reviewed, but material risks go unchallenged. What looks like oversight proves to be a reporting theatre. ESG exists, but it does not lead.
b. Disconnection from Enterprise Risk Management (ERM)
Scan a typical risk register of a mid-sized company and you will likely find familiar entries: operational, credit, cyber, reputational or regulatory risks. But sustainability exposures such as water scarcity, human rights violations, or climate transition risk areoften missing. This omission reflects a deeper structural misalignment. ESG risks are not just underreported, they are mismanaged.A major Indian outsourcing firm was recently embroiled in controversy after labour and data protection lapses surfaced. Global clients were drawn into the cross-border implications, revealing how ESG vulnerabilities within third-party ecosystems can escalate into legal, operational, and reputational crises when not integrated into enterprise risk frameworks.
ESG and risk teams usually operate on separate tracks, guided by different templates, language, and reporting cycles. There is limited dialogue, shared metrics, and few common touchpoints in governance. The consequences are tangible. Risks that are not integrated do not get assessed, tracked, or mitigated.
Decisions on capital deployment, supplier onboarding, or market entry move forward without proper accounting of ESG exposure. And when ESG risks crystallize, whether through forced labour allegations or carbon price shocks, they hit as surprises, not scenarios planned for. The fallout is reputational, financial, and at times regulatory.
c. Short-Term Fixes, Long-Term Blind Spots
ESG risk management in many mid-sized firms still remains reactive. Environmental near misses, whistleblower alerts, or supplier violations are resolved in isolation. They are treated as incidents to close, not signals of operational risk.
These events rarely trigger cross-functional reviews or governance reform. They are often viewed through conventional lenses like outsourcing, reputational, or compliance risk, rather than as ESG issues warranting systemic attention.
Most incident platforms are not equipped to tag and escalate ESG-related risks across risk taxonomies or internal audit programs. As a result, these incidents are captured but not translated into lasting controls or reforms. ESG concerns remain excluded from the formal risk universe, leaving gaps in ownership, escalation, and consequence management.
The problem is not that patterns go unnoticed. It is that they are seen, logged, and filed away without institutional learning. With no feedback loop between ESG events and core GRC systems, the organisation remains in a state of incident-by-incident reaction. The absence of structural course correction keeps ESG risk in the background, never part of the firm’s control spine.
d. ESG as Policy, not Practice
Many mid-sized firms have made substaintial progress in formalising ESG commitments, issuing environmental policies, supplier codes of conduct, and diversity statements. On paper, the structure appears sound but in practice, ESG often remains disconnected from core governance and risk processes.
In GRC terms, ESG policies are frequently documented but not operationalised. They may not inform procurement thresholds, risk assessments, or investment decisions. First and second-line functions often lack clarity on ownership, escalation, or how ESG ties into day-to-day decision-making. Without mapped controls, training protocols, and integration into assurance cycles, these policies function more as signals of intent than tools of control.
Compouding the complexity is proliferation of various frameworks leading to disclosure misalignment. Many organizations struggle to reconcile overlapping or divergent expectations, resulting in fragmented reporting and diluted strategic focus.
This gap is not always a result of indifference. Competing compliance pressures and resource constraints can slow down implementation. Without intentional follow-through, even the most well-designed policies fall short of delivering meaningful risk mitigation. ESG maturity must be measured not by the presence of documents, but by the presence of systems that activate them when it matters.
e. When ESG Goals and Rewards Don’t Align
In many mid-sized firms, ESG targets exist on paper but lack execution in practice. Sustainability teams may be commended for reporting achievements, yet the broader organization remains focused on financial KPIs that often conflict with ESG goals. Cost pressures get passed down the value chain leading to corner-cutting, while accelerated timelines increase the likelihood of environmental or safety incidents.
A key barrier is the weak integration of ESG into performance architecture. Where ESG metrics appear in bonus scorecards, they are often peripheral, vaguely defined, or outweighed by short-term financial goals. This imbalance is particularly visible at senior levels, where ESG objectives are seldom treated with the same urgency as revenue or margin targets.
The result is a misalignment between declared priorities and actual behaviour. Employees learn to focus on what is measured and rewarded. When ESG is not embedded in those levers, it struggles to influence decisions in a meaningful way, not because intent is lacking, but because the system is not built to support it.
f. Over-indexing on Reporting Tools, Underinvesting in Control Maturity
Across the mid-market, ESG dashboards and disclosure software are on the rise. Companies invest in sleek platforms that automate surveys, generate visual reports, and populate sustainability portals with curated metrics. Even though ESG data may feed disclosure reports, but it often bypasses the systems that govern enterprise control like incident management, RCSA, and third-party audits. The result is a disconnect where core risk systems remain unchanged, limiting the shift from insight to action.
Compounding this issue is the poor quality of ESG data generated by many reporting systems. Inconsistent methodologies, unverifiable metrics, and outdated sources often result in low-confidence inputs. When such flawed data becomes the basis for business decisions, it not only undermines credibility but exposes firms to material risk misjudgments.
A large European asset manager came under investigation in 2022 after national regulators launched a raid based on allegations of greenwashing. Although its ESG disclosures were extensive, internal records and control reviews indicated that several funds were marketed as ESG aligned without sufficient substantiation. The optics of compliance had obscured the absence of effective governance. The result was regulatory backlash, investor exits, and significant reputational damage.
The more firms over index on optics without reinforcing the control layer beneath, the more exposed they become to ESG failures, reputational damage, and regulatory sanctions that reporting alone cannot defend against.
Bridging the ESG gap requires more than software fixes or better disclosures. It calls for a reset in how companies assign ownership, integrate ESG into risk frameworks, and translate accountability into daily decisions. The blueprint that follows outlines practical steps mid-sized firms can take to move ESG from narrative to control reality, one that holds up under scrutiny and improves performance from the inside out.
Embedding ESG within ERM Framework – A blueprint
a. Governance & Strategy
Clarify ESG Ownership: Assign ESG accountability at the board and CxO levels. Establish cross-functional steering committees that include leaders from risk, operations, sustainability, legal, and procurement. Make roles explicit. When responsibility is shared without clarity, it leads to inaction.
Link ESG KPIs to Leadership Appraisals: Incorporate progress on ESG metrics into formal executive performance reviews. Tie variable compensation to tangible ESG outcomes, not just the completion of disclosure requirements.
Scrutinize ESG Trade Offs: Institutionalize ESG risk and benefit analysis in capital allocation, procurement, and growth decisions. All major investments should be assessed for ESG exposure by the relevant committees before approval.
Align with Risk Appetite and Code of Conduct: Embed ESG criteria within the organization’s stated risk appetite. Clearly define what levels of trade off between short term gains and long term risks to reputation, compliance, or sustainability are acceptable and what are not.
b. Risk Integration & Controls
Embed ESG in a Risk Based Framework: Integrate ESG into enterprise-wide risk identification, assessment, and escalation processes. Focus on what is material and purpose driven, ensuring ESG risks are treated with the same discipline as financial or operational exposures.
Expand the Risk Taxonomy and Assign Ownership: Update enterprise risk taxonomies to include exposures such as climate disruption, labour rights, data governance, and supply chain integrity. Ensure every function maps its relevant ESG risks into the central register with defined controls, owners, and mitigation plans.
Establish ESG-Linked Key Risk Indicators: Monitor leading signals such as supplier code violations, whistleblower reports, or environmental breaches. Set thresholds that trigger escalation through existing governance channels to avoid fragmented oversight.
c. People & Accountability
Build Practical ESG Fluency Across Functions: Move beyond theoretical training. Equip operations, finance, procurement, and HR teams with role-specific ESG guidance that informs day-to-day decisions, trade offs, and escalation procedures.
Distribute Responsibility Across the Front Line: ESG ownership should not rest solely with sustainability or reporting teams. Link ESG responsibilities to operational roles, with measurable targets tied to control implementation, risk mitigation, and incident reporting.
Enforce Structured Escalation for ESG Breaches: Treat ESG failures with the same urgency as financial or operational breakdowns. Supplier violations, environmental incidents, or workplace grievances must trigger a formal response, including remediation steps and governance review.
d. Data, Reporting & Technology
Integrate ESG into Risk and Control Systems: Move ESG from static reports to live data streams embedded in incident management tools, RCSA processes, and third party risk platforms. Ensure ESG risks and breaches inform how the organisation governs and responds in real time.
Design ESG Data for Actionability: Prioritise usability over volume. Enable procurement teams to flag supplier risks, operations to monitor environmental exposure, and risk committees to evaluate trade offs. Insight, not collection, is the objective.
Test Control Implementation, Not Just Documentation: Go beyond policy checklists. Monitor if ESG controls are actually followed, assess how they perform under pressure, and use internal audits to uncover weak links and emerging issues.
Use Technology to Scale Discipline, Not Bypass It: Leverage tools to centralise ESG data, trigger alerts, and map exposure. Technology should support control ownership and follow through, not replace it.
Care should be take however when introducing ESG scoring systems powered by AI. When underlying data or algorithms carry historical bias, AI tools can amplify discrimination, skew assessments. Organizations must exercise caution and ensure AI tools are explainable, monitored, and contextually validated.
Conclusion – Transitioning From Blueprint to Benchmark
Embedding ESG into GRC needs more than intent. It requires ongoing assessment. The indicators below offer a practical way to evaluate how ESG risk is being integrated across key decision-making processes. They reflect whether ESG is influencing governance, operations, and risk management in a consistent and structured manner.
These metrics go beyond compliance. When used thoughtfully, they provide insight into how ESG is shaping internal behaviours, influencing leadership decisions, and guiding procurement and oversight. Tracking trends across these indicators can help firms identify where integration is working and where it needs reinforcement.
External certifications can play a supporting role, provided they are used to validate embedded practices rather than serve as stand-ins for them. When done right, they help demonstrate that ESG is being taken seriously in practice, not just on paper.
For mid-sized companies at the ESG inflection point, the question is no longer about ticking the disclosure box. It is about control. True resilience comes from whether ESG risks are embedded into governance, operational controls, and decision-making frameworks.
This is a structural shift requiring clear ownership, alignment with enterprise risk, and readiness to adapt. Real resilience comes from how ESG informs how a company governs itself, manages risk, and drives accountability.
The real shift lies in moving from “Are we ESG-compliant?” to “Is ESG risk embedded in the way we govern, decide, and operate?”
When it comes to risk management, mid-sized listed companies often focus on external threats—cyberattacks, market volatility, regulatory changes. Yet, one of the most damaging risks can come from within: insider risk, where employees or trusted parties collude to commit fraud.
Insiders are behind a significant share of corporate fraud and data breaches, costing businesses millions. A recent global study by the Association of Certified Fraud Examiners (ACFE) found that organizations typically lose 5% of their annual revenue to occupational fraud (which by definition involves insiders), with total losses exceeding$3 billion in the cases studied. The median loss per internal fraud case was$145,000—a hefty hit for a mid-sized firm. Losses as a percentage of revenue tend to be higher in smaller organizations than in large enterprises.
In short, the threat from within can be as damaging as any external attack, yet it doesn’t always get the attention it deserves.
Defining the Insider Threat Spectrum
Insider threats span a spectrum of behaviors—malicious, conflicted, fraudulent, or negligent—each with distinct triggers and impacts. Understanding these typologies is essential for proactive risk management.
Malicious Insiders
Malicious insiders intentionally harm the organization through actions like data theft or sabotage. Triggers include financial distress, disgruntlement, or external coercion. For example, an IT administrator at a mid-cap tech firm might leak customer data to a competitor for financial gain, exploiting elevated access privileges. The 2025 Ponemon Institute report noted that 27% of insider incidents involve deliberate data exfiltration, costing$15.3 million on average.
Conflicted Insiders
Conflicted insiders prioritize personal gain through undisclosed vendor ties or related-party deals. Triggers include personal relationships or financial incentives. A 2023 EY Fraud Survey found 38% of fraud cases in mid-caps involve conflicts of interest, such as a procurement officer awarding contracts to a relative’s firm without disclosure. Weak oversight exacerbates these risks, as mid-caps often lack automated vendor screening.
Silent Fraud
Silent fraud involves subtle misconduct, such as skimming, expense misreporting, or privilege abuse, often enabled by weak controls. For instance, an employee inflating expense reports might go undetected without automated reconciliation, draining resources over time.
Negligent Insiders
Negligent insiders cause harm through human error or poor control hygiene, such as clicking phishing links or mishandling sensitive data. For example, an employee downloading malware via an unverified link could expose customer data, leading to costly breaches.
Third-Party Threats
Contractors or vendors who have inside access can compromise security, either intentionally or via lax practices.
Why Growing Companies Are Especially Vulnerable
Growing companies are often large enough to present ample opportunities for internal fraud, but they may not yet have the robust controls and corporate governance that mature enterprises deploy. Rapid growth can strain internal processes. New departments, higher transaction volumes, and more employees may outpace the development of a strong control environment.
Informal Trust Culture
Tight-knit teams often prioritize harmony over scrutiny. Employees hesitate to report colleagues, fearing conflict or disruption. Without formal escalation channels, early red flags go unnoticed. A study found 60% of employees avoid reporting conflicts of interest to preserve team dynamics, underscoring how silence becomes the norm in trust-heavy environments.
Limited GRC Resources and Budget Constraints
Most mid-sized companies operate with lean GRC teams. Budget constraints hinder investment in fraud detection tools like user behavior analytics or real-time alert systems. According to ACFE’s 2024 study, over half of all fraud cases occur due to weak or overridden internal controls—a risk magnified in firms lacking dedicated compliance capacity.Most mid-sized companies operate with lean GRC teams. Budget constraints hinder investment in fraud detection tools like user behavior analytics or real-time alert systems. According to ACFE’s 2024 study, over half of all fraud cases occur due to weak or overridden internal controls—a risk magnified in firms lacking dedicated compliance capacity.
Blind Trust in Long-Serving Employees
Familiarity breeds complacency. Many insider incidents involve staff considered loyal or beyond suspicion. The Ponemon Institute found that 1 in 5 insider frauds involved “trusted” employees exploiting privileged access. When firms equate tenure with integrity, they often ignore the need for independent oversight or segregation of duties, leaving room for misconduct.
Compliance Gaps in Listed Mid-Caps
Being publicly listed doesn’t guarantee governance maturity. Many mid-cap firms face regulatory obligations without scaled internal systems to meet them. A 2024 survey showed 55% of listed mid-sized firms lacked robust compliance frameworks, increasing exposure to fraud, conflicts of interest, and enforcement risks.
Neglect of Insider Behavior Monitoring
While external threats like cyberattacks, audits, and investor scrutiny often dominate risk discussions, internal behavior in mid-sized firms remains largely unmonitored. A 2024 report found that while insiders were involved in 60% of data breaches, only 25% of companies regularly monitor user activity. This oversight gap allows repeated privilege abuse or policy violations to slip through undetected.
Cultural Resistance to Monitoring Tools
Employee pushback is common when firms try to implement tracking tools. In trust-driven environments, monitoring feels intrusive and misaligned with the culture. A recent survey revealed that 63% of employees would consider leaving their company if strict monitoring measures were put in place. This resistance slows adoption of essential controls like access logging or behavioral alerts.
Overlapping Roles and Conflicts of Interest
In mid-sized setups, employees often wear multiple hats, including approving vendors, processing payments, and handling reconciliations. This lack of segregation weakens internal checks. ACFE reports that 42% of frauds stem from the absence or override of internal controls, such as dual approval or independent reviews.
Manual Workflows and Silent Fraud
Email-based processes, spreadsheet approvals, and informal reimbursements create room for “quiet” fraud. Without automated alerts or audit trails, misconduct can persist unnoticed. A 2025 Bloomberg case revealed how a mid-sized retailer lost$1.8 million over two years through undetected expense fraud, highlighting the cost of informal systems.
Regulatory Burden Without Execution Support
Compliance demands are growing, but mid-sized firms often lack the structure to execute. From data protection to ESG, obligations now rival those of large enterprises, without matching resources. The U.S. Chamber of Commerce noted in 2024 that 51% of small and mid-sized businesses see regulation as a key operational burden.
Overreliance on Financial Audits
Annual audits offer false comfort. ACFE data shows external auditors detect only 3% of fraud cases. Behavioral misconduct like override abuse or insider collusion rarely shows up in financial statements. Without internal controls focused on behavior, red flags remain buried in day-to-day operations.
Mitigating Insider Risk
Mid-sized firms often walk a tightrope between agility and oversight. With lean GRC teams, fast-moving operations, and high dependence on trust, insider risk becomes a quiet but potent threat, often surfacing only after the damage is done. Fortunately, leading companies are showing how risk exposure can be materially reduced through deliberate, scalable steps:
Build Professional Skepticism Across Vulnerable Functions The absence of healthy doubt is a core enabler of internal fraud. Teams often trust colleagues or assume “it must have been reviewed.” Embedding professional skepticism via training, risk orientation, and scenario-based workshops can shift the mindset from “compliance” to “risk management.” For example, a Southeast Asian mid-cap embedded a red-flag checklist in monthly reviews, flagging odd vendor payment cycles, duplicate invoices, and large round-number payments, unearthing a 3-year-old ghost vendor scheme.
Layer Forensic Thinking Into Control Design Traditional controls (approvals, reconciliations) often lack the forensic intent to catch manipulation. Mid-sized firms should embed anti-fraud thinking into finance and procurement workflows, e.g., flagging new vendors created by the same user who approves invoices, or detecting payment splits just below approval thresholds. In one Indian mid-cap, forensic review of vendor master data found multiple entries linked to a single PAN number, leading to the unravelling of a procurement kickback loop.
Regular Rotation of Duties in Sensitive Functions Fraud schemes often rely on a single insider managing a process end-to-end. Periodic job rotations, especially in roles like vendor onboarding, payroll processing, or loan disbursements, introduce fresh eyes and reduce opportunity. This approach helped a fintech firm in India detect a backdated disbursement manipulation after a temporary replacement questioned an old approval trail.
Maintain an Always-On Fraud Ledger Beyond incident response, firms should maintain a fraud event registry tracking red flags, near misses, overrides, and ethical hotline tips, even if they don’t lead to confirmed fraud. Patterns often emerge when seen over time. One APAC manufacturer built such a ledger, which helped internal audit connect repeated override incidents across multiple geographies, ultimately leading to the identification of a multi-country expense fraud ring.
Use Analytics to Spot What Human Eyes Miss User Behavior Analytics (UBA) and Data Loss Prevention (DLP) tools help surface subtle anomalies—after-hours logins, file transfers, unusual access routes—that are easy to miss otherwise. A Pune-based fintech used behavioral analytics to flag an employee repeatedly sending encrypted files to a personal account. The employee claimed it was for “offsite backup,” but further investigation revealed attempted IP theft. Behavioral AI can flag anomalies across cloud apps, VPNs, endpoints, and collaboration tools. Analysts report time savings of up to 70% during investigations when AI assistants triage alerts and surface contextual patterns.
Treat Culture as a Control Layer Controls fail silently when employees are conditioned to ignore red flags or assume silence is safer. Embedding ethical tone through leadership modeling, anonymous reporting channels, and regular training creates cultural antibodies. In one APAC energy firm, a junior procurement executive flagged a vendor relationship via an anonymous whistle-blower tool, leading to the early unravelling of a collusion ring that had persisted for over a year.
Secure Offboarding as if Breach is Guaranteed Exit events are when many insider incidents peak. Integrating HRIS and IAM systems ensures that resignations or terminations trigger immediate access revocation. Tesla’s 2023 incident, where former employees leaked sensitive data after their departure, is a case in point. A Southeast Asian R&D firm avoided similar fallout by enforcing just-in-time provisioning and de-provisioning protocols linked to HR workflows.
Have an Insider-Specific Response Playbook Most companies have IR plans, but few have tailored playbooks for insider threats, which are often more subtle and reputationally sensitive than external attacks. One U.S. retailer that received a tip-off of employee theft initiated an internal investigation within 48 hours, preserving digital forensics, locking access, and launching containment discreetly. The firm suffered minimal reputational damage, unlike a peer that took weeks to act and landed in the media.
Audit What You Assume Is Working Internal audit/assurance functions should be empowered to do anomaly-led investigations, e.g., looking for outlier spend patterns, non-business hour approvals, or repeated manual journal entries just before quarter close. Even one such “audit sprint” per quarter can raise deterrence significantly and align IA more closely with forensic objectives.
Run Integrity Checks on Third Parties and Employees Collusion risk is highest in procurement, sales, and distribution. Instituting continuous third-party screening, conflict-of-interest disclosures, and employee lifestyle audits (especially in high-risk roles) helps detect early signs. One Indian mid-cap FMCG firm used a third-party integrity check and found that a key distributor was also a silent partner in a logistics vendor, triggering reallocation of contracts.
Conclusion: Don’t Underestimate the Enemy Within
Insider risk is often under-discussed in boardrooms, overshadowed by flashier external threats. Recent cases from banks in India to factories in America demonstrate that misuse of trust and collusion are alive and well in 2024-25, costing businesses dearly. As companies push for growth, they must ensure not to fall into the trap of assuming “it can’t happen here.”
The truth is that as organizations grow, so do the opportunities for insiders to exploit gaps, especially if controls and culture don’t keep up.
The encouraging news is that many insider risks are manageable with foresight and vigilance. By learning from studies like the ACFE’s annual report and industry surveys, companies can understand where they are most exposed. For example, knowing that operations, accounting, and sales departments account for a large portion of internal fraud cases can prompt targeted control improvements in those areas.
Recognizing that collusion multiplies damage fourfold should spur better cross-checks and rotation in high-risk functions. And remembering that employees are often the heroes in detecting fraud emphasizes the value of a speak-up culture and employee training.
Ultimately, effective insider risk management is a balancing act: trust but verify. Companies should cultivate a high-trust workplace but verify that trust through robust controls and oversight. External defenses and cybersecurity matter, but they are not sufficient on their own. Internal vigilance is equally crucial.
In an era of advanced analytics and AI, businesses have powerful tools to monitor for anomalies; combined with human ethics and sound governance, these tools can tip the balance in favor of the honest majority. Mid-sized firms that embrace these principles will not only protect themselves from insider threats but also create a more transparent, accountable environment that investors, regulators, and employees themselves can have confidence in.
In the journey of growth, keeping an eye on the “enemy within” is now an essential part of sustaining success.
As mid-sized listed companies scale, their risk landscape grows more complex. Many still operate with fragmented data systems and ad hoc reporting frameworks. Unlike large enterprises with mature infrastructures, or smaller firms with manageable oversight, mid-sized companies often fall into a blind spot: “too complex to run manually, too constrained to modernize decisively.”
The result? Data exists but is scattered across systems, spreadsheets, and silos. Unstructured, unsurfaced, or untrusted. Risk visibility becomes partial, reporting cycles are reactive, and decision-making is shaped more by instinct than insight.
In this article, we unpack the top root causes behind this challenge. We also outline five strategic remediation moves; practical, scalable steps that mid-sized firms can take to build integrated, resilient, and insight-driven risk data ecosystems.
Because today, risk management is a data problem and solving it is a competitive advantage.
Top Root Causes of Underdeveloped Data & Reporting Frameworks
1 – Absence of a Strategic Data Governance Framework
Most under-developed data environments can be traced to the absence of a robust data governance strategy. Data governance encompasses the policies, standards, and processes that ensure data is accurate, secure, and available. In many mid-sized companies, it is either ad hoc or entirely missing. There’s no centralized framework assigning ownership or standardizing how data must be managed.
How it manifests: Different business units define and handle data independently. For instance, a single counterparty (customer/vendor/partner) may have multiple IDs across systems, distorting their true profile. These inconsistencies stem from the lack of enterprise-wide data definitions, taxonomies, and data catalogs.
Why it persists: Instituting data governance is challenging. It requires cross-functional coordination and often a cultural shift. Mid-sized firms may not necessarily have dedicated a Chief Data Officer or equivalent, leaving IT teams to enforce standards without executive clout. Moreover, some firms perceive governance as bureaucracy that slows down operations. If leadership is unconvinced, they won’t allocate time to build a governance committee or policies.
Impact on risk management: Without strong governance frameworks, companies struggle to aggregate and report risk data effectively leading to poor risk assessments and decision-making. A mid-tier bank without clear data ownership might find that its finance and risk departments use different definitions of “exposure,” resulting in conflicting risk reports. In manufacturing, lack of governance might mean safety incidents or quality defects aren’t logged uniformly, obscuring critical risk trends.
2 – Siloed Systems and Fragmented Data
Mid-sized companies often grow through business silos, each department or subsidiary implementing its own framework, models and structure to suit their maturity curve. The result is fragmented data architecture: customer data in one platform, sales in another, risk metrics in a spreadsheet, and so on, with poor integration between them.
How it manifests: Data silos hinder enterprise-wide visibility.
Attempts to create a “single source of truth” fail if systems don’t talk to each other. A bank’s lending unit and treasury unit might use separate reporting tools, making it laborious to compile an integrated risk report. Or consider a manufacturer where procurement and production each maintain separate inventory records. Without integration, the company cannot accurately assess supply chain exposures or working capital at a consolidated level.
Why it persists: Ironically, despite years of trying to build interfaces, the problem has in some cases worsened – over 40% of companies report that the number of data silos has actually increased, while only ~10% have improved company-wide information access.
Teams might resist sharing data (protecting their turf), and technically it can be challenging (or expensive) to connect legacy systems lacking modern APIs.
Impact on risk management: Data silos are kryptonite for risk oversight. If risk data is scattered, it’s difficult to get a holistic view of the organization’s risk profile. Correlations between risks may go unnoticed as seen in some recent bank failures. In summary, fragmentation undermines any robust risk management framework by preventing timely, accurate data consolidation.
3 – Legacy IT Systems and Technical Debt
The burden of legacy technology, outdated core systems or homegrown solutions that have been patched over time is nothing short of an industry norm. Legacy systems are often inflexible, incompatible with modern data tools, and prone to failure, collectively contributing to underdeveloped reporting frameworks.
How it manifests: A bank might still rely on a decades-old core banking system that wasn’t designed for today’s data demands, requiring batch processes to produce reports (meaning no real-time insight). A manufacturing company could be running an old version of an ERP that lacks modern analytics modules, forcing employees to export data into spreadsheets for analysis.
The prevalence of legacy tech is notable. Nearly 96% of IT professionals in one 2023 survey said they stillneed legacy applications in their environment, and only 4% reported not using any legacy applications.
Why it persists: Replacing core systems is often viewed as risky, expensive, and disruptive. The classic “if it isn’t broken, don’t fix it” mentality.
Technical debt (the cumulative cost of quick-fix IT decisions) accumulates because the company opts for short-term patches over long-term rebuilds.
Impact on risk management: Outdated technology directly impacts risk monitoring and reporting. Legacy systems may not capture the level of data granularity needed for advanced risk analysis (for example, a legacy manufacturing system might not log each production anomaly needed to predict equipment failure risk). They often lack audit trails or modern security, elevating operational and cyber risks.
4 – Cultural Resistance to Change and Data Sharing
Organizational culture plays a pivotal role in the success of data initiatives. Long-standing habits and attitudes create resistance to adopting new data practices or sharing information freely.
How it manifests: Front-line managers may cling to their known and used ‘excel spreadsheets’ and gut-feel decision making, viewing new data systems with suspicion. In many ways, new data systems also expose known but unaddressed failures to the limelight.
Some departments also treat data as a power source to hoard. For instance, the sales team might be reluctant to input detailed client data into a central CRM if they’ve historically managed relationships personally. The XPLM industry survey highlights that two-thirds of respondents said their corporate culture actually favors the emergence of data silos, and 71% admitted that departments “do not want to share their knowledge” across the organization.
This culture can doom data projects; employees might refuse to adopt a new reporting tool, or deliberately bypass official processes (keeping shadow records) because they don’t trust or understand them.
Why it persists: Cultural change is one of the hardest challenges in any organization. Mid-sized companies often have veterans and legacy practices deeply ingrained – “this is how we’ve always done it” can be a mantra. If leadership isn’t actively driving a data-centric culture, middle management is unlikely to enforce it.
Additionally, without adequate training or clear communication of benefits, staff may genuinely fear that new data systems could make their roles redundant or expose their mistakes, thus resisting involvement. There’s also the issue of incentives: if performance metrics don’t reward data sharing or accuracy (and instead only reward short-term results), employees have little motivation to change their behavior.
Impact on risk management: Cultural resistance can sabotage even well-intentioned risk data initiatives. If, say, the risk team implements a new enterprise risk management (ERM) system but business units don’t feed it with timely data, the system becomes an empty shell. An unsupportive culture can nullify the best tools and keep the organization in a reactive stance, where data is seen as a threat or burden rather than a shared asset for informed risk-taking.
5 – Increasing Regulatory and Reporting Complexity
The external environment is raising the bar on data and reporting, and many companies are finding their frameworks lagging behind these evolving requirements. Whether it’s financial regulations, data privacy laws, or sustainability reporting standards, the complexity and volume of reporting expectations have grown exponentially – and mid-sized firms are struggling to keep up.
How it manifests: A regional bank might face new stress-testing data requirements from regulators that its current risk systems cannot support, resulting in frantic efforts to pull the right data. Manufacturing companies now encounter detailed ESG expectations, for instance, European mid-sized listed firms will soon need to comply with the EU’s Corporate Sustainability Reporting Directive (CSRD), tracking metrics from carbon emissions to supply chain due diligence. Many are unprepared.
Why it persists: Unlike large corporations, mid-sized companies typically do not have big compliance departments or the latest Reg-Tech tools. They may be caught off guard by new regulations or find them disproportionately burdensome.
Impact on risk management: Compliance risk becomes a top concern. But beyond compliance, the spirit of these regulations (be it transparency in risk or sustainability) is to drive better decision-making. If a mid-sized firm is only doing the minimum, it likely isn’t leveraging the data to actually improve risk management.
6 – Talent and Skills Gap in Data Analytics
Even with the right tools, organizations need skilled people to build and maintain robust data frameworks. Mid-sized companies often face a talent crunch in this area. They may lack experienced data architects, analysts, or risk data specialists on staff.
How it manifests: The IT team might be small and generalized, without a dedicated data engineer or data scientist. Mid-sized firms often cannot offer the same compensation or career trajectory as large tech firms or banks, leading to a smaller talent pool.
Why it persists: The demand for data and analytics talent has exploded in recent years (with the rise of AI, big data, etc.), and supply has not kept up. Mid-sized companies often have to “grow” their own talent internally, which takes time. Hiring experienced professionals is competitive and costly. Additionally, some mid-tier companies are located outside major tech hubs, making recruitment harder. There’s also the issue of retention.
Impact on risk management: A skills gap can severely hamper risk oversight. Insufficient talent leads to heavy reliance on a few key individuals or external vendors; this concentration is a risk in itself. If those individuals leave or contracts lapse, the organization’s data capability could collapse. Risk professionals in such settings often find themselves doubling as data cleaners and report builders, diverting them from higher-value risk analysis.
5 Strategic Remediation Moves for Mid-Sized Organizations
Mid-sized companies can turn these challenges into opportunities by proactively strengthening their data and reporting frameworks. Below are five strategic remediation moves spanning technology, governance, and people to help resolve or mitigate the above root causes. These strategies are interrelated and can be pursued in parallel:
1 – Establish a Robust Data Governance Framework with Executive Ownership
Firms should formalize a data governance program that defines clear roles, responsibilities, and policies for data management. This also means appointing accountable data owners/stewards in each domain. To succeed, governance cannot be an IT-only initiative.
It needs top-down endorsement and enforcement. Leadership should treat data as a strategic asset, regularly reviewing data governance progress just as they would financial results.
The key is also continuous improvement: governance isn’t a one-time project but an ongoing program that adapts as the company grows and regulations change.
2 – Invest in Modern, Scalable Data Architecture and Tools
A strategic upgrade of technology can pay huge dividends. Mid-sized organizations should evaluate and invest in scalable data infrastructure that could involve moving to cloud-based platforms, implementing a unified data warehouse or lake, and deploying business intelligence (BI) and reporting tools that automate data aggregation and visualization.
Modern cloud solutions are increasingly accessible to mid-market companies (often offered in modular, pay-as-you-go models), lowering the barrier to entry. Key considerations would be toprioritize integration-friendly solutions and adopt tools that reduce manual work, such as ETL for moving and reconciling data
3 – Strengthen Data Talent and Literacy Across the Organization
People are the linchpin of any data strategy. Companies should invest in their human capital by both acquiring and developing data skills. If hiring full-time is difficult, engaging external consultants or service providers on a project basis can jump-start initiatives while transferring knowledge to internal staff.
On the development front, companies should launch data literacy programs so that employees at all levels become more comfortable with data and analytics tools.
A focus on talent and literacy sends a message that data isn’t just the IT team’s job, it’s everyone’s responsibility.
4 – Foster a Data-Driven Culture with Strong Change Management and Incentives
Leaders should consistently communicate the importance of data in achieving the company’s goals, and celebrate data-based decision making.
Some firms establish cross-functional teams or “communities of practice” around data, which break down silos by design. It can also help to start with small wins. Pilot the new framework in one department, refine it, and then expand, so people see proven benefits.
A data-driven culture also means employees become more likely to report issues or anomalies when they occur, rather than hiding them, because they know management wants to hear the data even if it’s bad news.
In essence, technology and processes might provide the tools, but culture is the soil in which a data-driven enterprise either withers or thrives.
5 – Align Data Initiatives with Risk Management and Compliance Objectives
Lastly, mid-sized organizations should explicitly try and link their data framework improvements to their broader risk management and compliance goals. In practice, this means using risk-based criteria to drive data projects: focus on the data that matter most for the company’s risk profile and regulatory requirements.
Some mid-sized firms establish a Risk and Data Steering Committee that meets regularly to ensure data initiatives are evaluated in terms of risk reduction and compliance impact. Additionally, keep an eye on upcoming regulations and proactively build capability to meet
Ultimately this alignment creates a virtuous cycle: good data feeds into good risk management, which identifies areas for improvement, which in turn drives further data enhancements. By making risk management a key outcome of data strategy, companies ensure their data framework upgrades truly fortify the organization’s resilience and not just its operational efficiency.
Conclusion
Transitioning to a mature data and reporting framework is undoubtedly a journey, not an overnight fix. However, by understanding the root causes behind their current shortcomings, organizations can target their efforts more effectively.
The challenges outlined often interact, but the good news is that the remediation moves are mutually reinforcing as well. With committed leadership, smart investments in technology, empowered people, and a culture that values information, companies can evolve their data practices significantly. The payoff is more than just better reports. It is improved risk foresight, stronger compliance, and enhanced decision-making agility.
Sources:
Basel Committee on Banking Supervision (BCBS 239) progress reports (2023)
BIS reports on supervisory expectations for risk data frameworks
Case studies: Silicon Valley Bank collapse analysis, 2023 U.S. Senate testimony and Fed reviews
Sero Group: Implementing Data Governance for Small and Medium-Sized Businesses
XPLM (2023): Study on Enterprise Data Silos and Cultural Resistance to Data Sharing
Gartner, Forrester, and IDC insights on enterprise data architecture adoption
QBE Global Risk Index (2023): Mid-Market Risk Prioritization and Preparedness Survey
Hyperproof GRC Benchmark (2024): Risk and Compliance Operations in Fragmented Environments
Sage (2023): SME Cloud and Sustainability Technology Trends Report
IDC SMB Tech Pulse (2023–24): Cloud adoption rates and tech spend forecasts for mid-sized firms
McKinsey Digital: The Value of a Scalable Data Architecture for Mid-Sized Enterprises
World Economic Forum: 2023 Global Talent Outlook
Udemy for Business: Skills Gap in Data Literacy 2023 Report
