Norman Marks

The Institute of Internal Auditors' updated Three Lines Model has reignited a longstanding debate over where risk management belongs within an organization's governance structure. In this commentary, governance and risk expert Norman Marks examines whether the revised definition of the second line finally reflects the reality of modern risk management, or simply broadens the concept so far that it loses much of its practical value. He argues that while the new language is an improvement over earlier versions, it raises fundamental questions about the purpose of the model and whether it still meaningfully distinguishes assurance providers from decision-support functions.

In this article, Norman Marks examines the findings from Gartner’s latest emerging risk survey, arguing that the growing prominence of AI-related concerns signals a meaningful shift in how enterprise leaders are thinking about operational risk, decision-making, and organizational preparedness.

In this article, Norman Marks explores what the future holds for internal auditing as AI, automation, and rapidly evolving business processes begin to reshape the very foundations of risk and control. Drawing on a real-world anecdote, he challenges auditors to rethink not just their tools, but their purpose, urging the profession to move beyond incremental change and confront the deeper question of what meaningful assurance looks like in a world where the rules are being rewritten in real time.

In this article, Norman Marks explores a familiar but often misunderstood reality for risk and internal audit professionals—risk is everywhere, but not every risk deserves equal attention. Drawing on a reader’s challenge to conventional thinking, Marks examines the limits of risk registers, the pitfalls of overextending audit scope, and why effective risk management ultimately comes down to prioritization, judgment, and better decision-making rather than attempting to catalog or control every possible threat.

If you want credibility and trust from management, your reports need not only to be accurate but also fair and balanced. Let me give you a real-life example from my time as a VP in IT at a large financial institution.

In this article, Norman Marks reflects on a recent exchange sparked by Alex Sidorenko’s thinking on risk and decision-making, exploring where they strongly align and where a critical distinction emerges around the concept of uncertainty. While agreeing that risk management should move beyond static risk lists and toward enabling better decisions, Marks challenges how the term “uncertainty” is often understood and applied in practice. The result is a pragmatic reframing of risk conversations—one grounded in real managerial decision-making rather than abstract definitions or theoretical precision.

In this article, Norman Marks reflects on a handful of recent and not-so-recent pieces that, taken together, offer a revealing snapshot of where internal audit is headed and where it may be at risk of losing its way. Drawing on insights from industry leaders, consultants, and former global audit officials, Marks contrasts the profession’s growing ambition around agility, insight, and relevance with an increasingly prescriptive standards environment that threatens creativity, judgment, and imagination. The result is both a cautious critique and a hopeful argument for an internal audit function that stays forward-looking, tailored to the business, and grounded in professional judgment rather than rigid process.