We have all done it. You are at an airport waiting for a flight. Your train journey is going to take another two hours. You have just checked into a hotel, or perhaps you are sitting in a café trying to get some work done. Your mobile signal isn't great, so you look at the available networks and see exactly what you need: free Wi-Fi.
Most organizations know what they would do if a critical system went down. There are incident response plans, disaster recovery arrangements and business continuity procedures designed for exactly that scenario. But there is another question we don't ask nearly as often: What happens if the technology hasn't failed, but your organization can no longer use it?
For a long time, seeing someone or hearing their voice gave us a reasonable level of confidence that we knew who we were dealing with. If your manager called, you recognized their voice. If a senior executive joined a video meeting, you could see them on the screen. There was usually little reason to question whether the person you were speaking to was actually who they claimed to be.
The more time I've spent working in Governance, Risk and Compliance (GRC), the more I've realized that a good risk assessment is rarely about preventing something from happening. It's about understanding what could happen, deciding whether the organization is comfortable with that level of risk, and making sure the right controls are in place before moving forward. That is a very different conversation.
Whenever I tell people that I work in Governance, Risk and Compliance (GRC), the reaction is usually the same. “So, you spend your day writing policies?” It’s a fair question because, from the outside, that’s exactly what GRC looks like. Before I started working in this field, I probably would have said the same thing. The reality is very different.
Access Login