In the latest piece from Norman Marks, the veteran governance, risk, and audit thought leader takes a bold leap into the near future, imagining how AI could fundamentally reshape decision-making, risk management, and the role of internal audit. Through a vivid crystal-ball scenario, Marks explores what happens when AI becomes a trusted partner for executives, operations, and assurance functions alike.
When JPMorgan Chase’s CISO took to the stage earlier this year and called on SaaS providers to “do better” on resilience, it wasn’t just another passing soundbite. It was a rare public signal from one of the most security-mature organizations on the planet — and the timing could not have been sharper.
In Norman Marks’ latest piece, he dives into the persistent misconception that cyber risk stands apart from broader business concerns. Drawing on timeless advice from former Protiviti executive Ed Hill and tying in new findings from Qualys’ 2025 cyber risk report, Marks makes the case for breaking down silos and treating cyber as just one of many risks competing for limited resources and executive attention.
Flaws in traditional enterprise risk management (ERM) and legacy internal audit (IA) practices aren’t exactly a secret. Risk registers, heat maps, and audits focused solely on internal control deficiencies may look tidy in a board report, but they rarely reflect how risk really works or how organizations actually fail.
The future of GRC is not simply digital, it’s decisively autonomous. It’s not just about processing power or clever dashboards. It’s about cognitive capability woven into the operational fabric of the organization—fluid, contextual, and self-directed. It’s orchestrated intelligence with agency.
In Norman Marks’ latest piece, he challenges internal auditors to reflect on their role, their mindset, and their real value to the organization. Drawing from personal experience and professional insight, Marks lays out a series of contrasts that help auditors pinpoint where they stand and where they might want to go.
The UK’s newly released 2025 National Risk Assessment of Money Laundering and Terrorist Financing (NRA) marks a critical turning point in how financial crime risk is expected to be understood, assessed, and managed.