The certificate was on file. The network was burning. And so was your reputation.

2:47 a.m. Ransomware is moving through the network faster than the response plan ever imagined. The on-call engineer opens the playbook, reaches the containment step, and freezes.

He has never actually done this.

He attended the training. The certificate is on file. The audit passed three months ago. On paper, he was ready. In reality, he was not.

Right now, the gap between his certificate and his capability is spreading at machine speed. And that gap has a name. You learned it from a slightly inappropriate uncle.

Assume.

You know the saying. When you assume, you make a donkey out of u and me. We will keep it at donkey. But remember that word. It is the foundation of every executive’s workforce assurance. The cracks are showing.

Three months earlier

An audit room. The auditor reaches the section on personnel capability and asks three questions:

Does this individual have a training plan? Yes.

Did they attend training this year? Yes, here is the certificate.

Is more upskilling scheduled next year? Yes, it is in the LMS.

Tick. Tick. Tick. Control satisfied. Box checked. Risk unchecked.

Now read those questions again.

Not one asks whether the person can do the job when it counts. Not one connects the training to the critical controls your business actually relies on. Not one checks whether the role is even defined consistently enough for “right person, right role” to mean anything in a crisis.

A certificate of completion proves someone sat in a room. Or left a video running in a browser tab while answering an email.

That evidence passes audits. In banks. In hospitals. In critical infrastructure. In agencies responsible for national security.

Every year. Everywhere.

The part nobody wants to say out loud

Ask your organization three questions.

  1. What skills do we have?
  2. What skills do we need?
  3. Where are the defensible gaps?

Almost nobody can answer with evidence. They answer with proxies.

Titles. Resumes. Course completions. Manager’s opinion. Job descriptions written by three different people across ten years that don’t even agree on what success looks like.

So every organization runs three realities at once:

  1. The skills it thinks it has.
  2. The skills it believes it needs.
  3. The skills it can actually prove.

The gap between those realities is not an HR inconvenience. It is a commercial and operational risk sitting inside your GRC program, wearing a lanyard and a completed training plan.

Your access controls assume the administrator is competent. Your incident response plan assumes the responders are truly capable. Your transformation budget assumes the workforce can execute what you just bought. All of it depends on assumptions you would never accept in a P&L review. Period.

Assume. Assume. Assume.

Donkeys, as far as the eye can see. And every one of them is a risk you’re carrying on your balance sheet.

Here is the part that should annoy you

The answer isn’t new. It’s 25 years old.

It is called SFIA, the Skills Framework for the Information Age. A common, rigorous, vendor-neutral language for digital skills. Version 9 today. Version 10 in development. Maintained by the SFIA Foundation, a non-profit with no commercial interests.

That non-profit status is a feature, not a bug. No vendor can bend the framework toward their product catalog. No license fees decide who gets access.

The language stays trusted, global, and neutral, which is exactly what a standard should be.

The only catch? Non-profits do not run Super Bowl ads. So while SFIA quietly became the backbone of digital workforce planning across Oceania, the UK, and governments worldwide, much of the market never got the memo. It might be the best-kept secret in workforce capability. That part we can fix.

The world’s most mature answer to “what does this role require, and what does this person actually have” sat quietly available the entire time organizations were getting waved through audits on attendance certificates.

A framework on a shelf assures nothing

Operationalizing it is the work. SkillsTX has spent more than 10 years doing exactly that, helping individuals, companies, and entire countries measure and evidence skills against SFIA. Real profiles. Real gap analysis. Role definitions that mean the same thing in Sydney, Seattle, and Saskatoon. This isn’t theory. This is commercial reality.

Two things just made this urgent for every executive accountable for results.

  1. SkillsTX recently acquired CredentialsCloud and welcomed Dr. Peter Beven (FAITD) to our board. We’re all in on extending the same evidence discipline we’ve used SFIA and ICT to any framework, in any industry, with a body of knowledge (BoK). Verified, portable, comparable proof instead of a wall of badges.
  2. AI is killing the worst part of skill and competency assessment: the exam feel. Our TXpertIQ AI agents turn it into a conversation with a colleague about what you worked on this week/month/year and what came of it. The AI gathers, structures, and strengthens the evidence. Humans still review and decide. The rigor stays. The friction goes.

One more thing. If AI agents are doing work in your organization, their capability should be evidenced against the same framework as the humans beside them. Otherwise, you have just created a new blind spot. It is one you cannot afford.

The question to sit with

You would never accept “we plan to reconcile the accounts next year” as proof that the books are sound.

So why do you accept “they have a training plan” as proof that the workforce is capable?

The challenge, offered with respect

To the leaders in audit, GRC, cyber, HR, and L&D reading this: you are some of the most rigorous professionals in any organization. The checkbox was never related to laziness. It was inherited. Nobody handed you a better instrument, so you used the one that existed.

But the instrument has changed. So the question changes too, and I would like it answered in the comments:

If your organization had to prove this quarter that the people defending its most critical controls actually hold the skills those controls require, could you produce the evidence? Not the training records. The evidence.

If yes, tell me how you do it. I will learn something.

If not, tell me what is stopping you. Budget, tooling, politics, and role definitions, all of the above.

Both answers move this profession forward. Silence is the only one that does not.

The standard exists. The system of record exists. The verification layer exists. The only thing left between you and defensible workforce evidence is the assumption that a checked box is good enough for your business, your board, or your shareholders. That assumption is your risk.

And we both know what happens when we assume.

#SkillsTX #SFIA #DitchTheResume #OwnYourSkills #WorkforcePlanning #SkillsTech #DigitalTransformation #AI #FutureOfWork #SkillsBasedOrganization #EvidenceBasedCredentials #HRTech #DigitalTalent #SkillsFirst #ITAudit #ISACA