It's planning season for many risk management and internal audit functions. CROs and CAEs are deciding where to spend their limited resources, what work to prioritize and what they hope to accomplish in the coming year. I have a question for them. Do you see yourselves in the decision and performance support business?
The World Economic Forum’s new Risk Management, Reimagined: Outlook to 2035 is one of the more thoughtful critiques of traditional risk management I have read in some time. It also stops one important step short.
In a recent LinkedIn post, I asked why so many organizations are trying to assess AI as a standalone risk. I think that question gets to the heart of what is going wrong with much of the discussion around AI governance. There is no shortage of people trying to work out how organizations should govern AI. New frameworks are appearing, risk taxonomies are being built, internal audit teams are developing programs, and familiar questions are being asked about bias, security, compliance, privacy, and hallucinations.
I recently posed what I believe is one of the most important unanswered questions in governance on LinkedIn: Who is auditing the governance framework? The responses confirmed two things. First, many practitioners instinctively recognize the gap. Second, there is still remarkably little agreement on who should be responsible for assessing governance effectiveness or even what "effective governance" actually means. That conversation reinforced why I have been asking this question for decades.
In a recent LinkedIn post, I posed what I believe is one of the most important questions facing the risk management and internal audit professions today. If risk is defined in ISO 31000 as "the effect of uncertainty on objectives," why don't both professions begin with an organization's Mission Critical Objectives? It seems like an obvious place to start. Yet in most organizations, it isn't.
In a recent LinkedIn post, I argued that the biggest barrier to effective governance is not technology, cost, standards, or even board interest. It is management's reluctance to provide boards with reliable information on uncertainty and performance linked to Mission Critical Objectives (MCOs), combined with boards' reluctance to insist on receiving that information. The reaction to that post reinforced my belief that this issue sits at the center of one of the most important, and least discussed, governance challenges facing organizations today.
A recent post I shared on LinkedIn on the future direction of risk management and internal audit generated a lot of discussion. Not because the ideas were particularly radical, but because many risk and internal audit professionals recognize the profession is reaching an inflection point.
Access Login