OpenClaw: The hidden cyber risks lurking in AI
ArticleNew autonomous AI tools are changing how risk enters organisations, often without visibility or approval. How can the people responsible for security and resilience tackle them.

Many charities embark on ambitious system implementation projects with significant investments and well-intentioned planning, yet, many of these initiatives still fall short of expectations and sometimes fail altogether. Paul Rao and Deepak Madan explore the top five reasons why system implementations often falter, and provide actionable recommendations that will empower charities to navigate the complexities of system implementation more effectively
In recent years, the common pitfalls and recurring challenges are increasing with the rate of new projects and system implementations happening, underlining the criticalness of addressing key areas to ensure project success.
The main reasons for failure include over-reliance on third-party suppliers, misunderstanding stakeholder needs, quick changing market trends, challenges in fundraising and volunteering behavior, limited opportunities for customisation, inconsistent supplier performance, communication problems, and inadequate governance or monitoring.
Whether you are planning a new system implementation or reviewing the risks of an existing approach, understanding why programmes fail is essential. We highlight the most common failure points – and practical steps you can take to avoid costly mistakes and deliver long-term value from technology investment.
Charities frequently turn to third-party suppliers to support system implementations, whether it be for industry standard systems, systems integration skills or project management services. While leveraging external suppliers can bring valuable skills and accelerate project timelines, excessive dependence on these suppliers often introduces significant risks that can derail an implementation.
Projects that rely too heavily on third-party can create a real danger of misalignment between evolving business needs and supplier capabilities. This can lead to delays, cost overruns, unmet objectives, and sometimes project failure.
The culmination of the following factors can create a high-risk environment for system implementations.
One of the primary risks associated with heavy reliance on third-party suppliers is the presence of rigid contract terms. These contracts are often standardised to protect the supplier’s interests, leaving little room for adaptation as project requirements evolve. When a business’s requirements change mid-project, inflexible agreements can prevent the necessary adjustments, resulting in misalignment between the organisation and the supplier. This lack of adaptability can cause delays, increase costs, and, in some cases, lead to project failure if critical changes are not addressed in a timely manner.
Third-party suppliers often have established methods, tools, and frameworks that may not fully align with a client's operating enviromnent. When suppliers resist tailoring their approach or product to suit specific organisational needs, the system implementation may lack necessary configuration. This can result in a solution that only partially meets the business objectives or forces the organisation to adjust its processes to fit the system, rather than the other way around. Resistance to change - from both the supplier and internal stakeholders - can compound these issues, reducing the effectiveness of the new system and lowering user adoption once it is implemented.
Another common challenge arises from inconsistent performance across different third-party providers. Where multiple suppliers are involved, varying levels of service quality and differing standards can create confusion and inefficiencies. Alack of standardisation in processes, documentation, and communication makes it difficult to maintain a unified project direction. This inconsistency can result in delays and errors, ultimately compromising the quality of the implementation.
Effective communication is crucial during any system implementation, especially when external suppliers are involved. However, excessive reliance on third parties can introduce communication barriers such as misunderstandings, language differences, or misaligned expectations. These challenges can lead to missed deadlines, duplicated efforts, or overlooked requirements. Furthermore, insufficient monitoring of third-party performance exacerbates these risks, as issues may go undetected until they have already impacted the project.
To mitigate these risks, organisations should aim for balanced partnerships that share risk and accountability. Maintaining flexibility within contracts, establishing robust communication channels and actively monitoring supplier performance throughout the implementation process can help maximise benefits of external expertise while retaining the agility and control for necessary for success.
The successful implementation of any new system requires robust stakeholder engagement and comprehensive business readiness. When these elements are overlooked, the likelihood of failure significantly increases, often resulting in operational disruption, wasted resources, frustration amongst system users and a diminished return on investment.
Stakeholders – such as end-users, managers, and executives – provide essential insights into current processes, pain points, and continuous validation of evolving requirements. If they are not actively involved and engaged throughout the project, there is a risk of misaligned expectations and a lack of critical input. This disengagement can manifest as limited feedback, poor collaboration, and ultimately, resistance to change. When people feel excluded from decisions that affect their daily work, motivation tends to wane, leading to decreased enthusiasm for the new system and increased resistance to its adoption.
Similarly, a lack of business readiness can undermine even the most well-designed technical solutions. Business readiness encompasses adequate training, sufficient resources, and effective communications. Inadequate training leaves staff ill-prepared to operate the new system, resulting in errors and frustration. Insufficient resources – whether in terms of personnel, time, or equipment – hamper smooth implementation and may force teams to cut corners. Poor communication means that key messages about the system’s benefits, timelines, and requirements are not clearly conveyed, fostering uncertainty and confusion.
Cultural resistance presents an additional challenge. If an organisational culture is not receptive of change, even the best systems may fail to gain traction. Employees may revert to familiar processes, resist new ways of working, and question the value of the transformation. This often results in organisational inertia – a tendency to maintain the status quo and avoid taking action – further slowing progress. These issues can be compounded by decreased motivation and poor collaboration, which further impede progress and contribute to project delays.
Ultimately, the absence of strong stakeholder engagement and business readiness leads to teams being unprepared to adopt the new system. This can result in operational disruptions, increased costs, and the failure to realise intended benefits. For charities, where regulatory compliance and efficiency are paramount, ensuring that stakeholders are actively involved and the business is fully prepared is not just best practice – it is essential for successful system implementation.
Another cause for failure is the inability of requirements and project plans to keep pace with rapidly evolving external factors. System implementations are particularly vulnerable when organisations do not proactively manage the risks associated with evolving external factors.
In any dynamic landscape, charities must contend with changes in regulations, market trends, technological advancements, and shifting stakeholder needs. When these external influences are not adequately considered or addressed, the likelihood of system implementation failure increases significantly.
Examples of environmental influences:
Regulatory expectations by the Charity Commission are subject to frequent updates, particularly regarding governance, reporting, and compliance standards. New regulations or guidance from the Commission can be introduced at any stage of a system implementation. If a charity’s system requirements are not routinely reviewed and revised to reflect these changes, the solution may fall out of compliance. In some cases, the effort and expense required to retrofit compliance updates into an ongoing project can be substantial, leading to significant delays or the need to abandon the initiative altogether.
Trends shift quickly, driven by preferences and competitive pressures. A system designed to address yesterday's trend realities may be ill-equipped to handle new demands. For example, a charity retail management system built without accounting for today’s digital and multichannel expectations will struggle to support modern operating models. Failure to anticipate and respond to market changes can leave organisations with systems that do not deliver value or competitive advantage.
Technology moves at a remarkable pace while system implementation projects can span several years. During this time, new tools, platforms, and methodologies are almost certain to emerge. If the project is based on outdated technology or fails to integrate newer, more effective solutions, it may result in a system that is obsolete upon launch. This can lead to poor performance, lack of scalability, and increased maintenance costs, while also preventing the organisation from realising the intended benefits, thereby undermining the project's long-term success.
The needs and expectations of beneficiaries, donors, employees and partners continue to change. If these are not regularly revisited and incorporated into the system requirements, the final product may fail to meet user needs, resulting in low adoption, dissatisfaction, and ultimately, project failure.
Regular review and adaptation of requirements in response to regulatory changes, market trends, technological advancements, and stakeholder needs are essential to ensure alignment and project success.
When charities embark on the journey of implementation, one of the pivotal decisions they face is whether to customise the solution to meet specific needs, or to rely on standard configuration options. While customisation may appear attractive – promising a perfect fit for unique processes and requirements – it often introduces significant risks that can undermine the success of the entire project.
Excessive customisation invariably leads to increased complexity. Custom features and bespoke workflows can make the system more difficult to understand and operate, both for end users and for those responsible for its ongoing management. This complexity can slow down implementation timelines, inflate costs, and create unforeseen technical challenges that disrupt established business processes. Rather than streamlining operations, a heavily customised system can introduce inefficiencies, as staff are forced to adapt to altered workflows that may not align with their day-to-day activities.
Training and adoption are also impacted. Standard systems benefit from training materials and supplier support. Heavily customised solutions often require bespoke training programmes, increasing cost and reducing adoption as users struggle to understand tailored functionality.
Support and maintenance challenges follow. Customised systems frequently rely on specialist knowledge, increasing dependency on individuals or externals consultants and raising long-term operational risk. leave.
Ultimately, the risk is that the system becomes unsustainable in the long term. With each custom feature, the gap between the implemented solution and its supported baseline widens. Charities may find themselves unable to upgrade or integrate with new technologies without extensive redevelopment. In worst-case scenarios, the system may fail outright, leaving the organisation exposed to operational disruptions and financial loss.
In summary, prioritising standard configuration options and keeping systems simple is often the wiser approach. It reduces complexity, facilitates training, streamlines support and maintenance, and ensures greater stability and adaptability for the future.
System implementations are inherently complex undertakings, often involving multiple workstreams, stakeholders, and dependencies. One of the primary reasons such projects fail is inadequate technical change control throughout the implementation lifecycle. Without robust change management processes in place, the risks of scope creep, compromised end-product viability, and convoluted support and maintenance requirements increase significantly.
Poor technical change control allows for unplanned or inadequately assessed modifications to be introduced into the system. These uncontrolled changes may impact other project workstreams, creating unforeseen dependencies or conflicts. For instance, a seemingly minor adjustment in one module could inadvertently disrupt another, leading to delays and additional costs as teams scramble to address the knock-on effects. This lack of coordination undermines the overall integrity of the implementation effort.
Furthermore, when changes are not subject to proper governance and challenge, the viability of the end-product can be severely compromised. Decisions made in haste, or without adequate technical scrutiny, may result in a system that fails to meet business requirements or is riddled with technical debt. Over time, these issues can erode the expected benefits of the implementation, leaving stakeholders dissatisfied and the organisation unable to realise a return on investment.
Complicated support and maintenance are a consequence of poor technical change control. As undocumented or poorly executed changes accumulate, the system becomes increasingly difficult to manage and troubleshoot. This complexity not only drives up operational costs but also increases the risk of outages or security vulnerabilities. Failure to enforce rigorous technical change control throughout the system implementation lifecycle can lead to project overruns, diminished value, and heightened operational risks. Effective governance, transparent processes, and thorough impact assessments are essential to safeguarding the success of any system implementation.
If you would like to discuss any of the above areas or your own system implementation project, please get in contact with Paul Rao and Deepak Madan.
New autonomous AI tools are changing how risk enters organisations, often without visibility or approval. How can the people responsible for security and resilience tackle them.
Rising insurer exposure to private credit is attracting increasing regulatory scrutiny, with concerns over transparency and systemic credit, liquidity and underwriting risks.
TPR has sharpened expectations for pension scheme administration, highlighting key risks around governance, data integrity and oversight that trustees must act on.