Insights

The House Financial Services Committee has advanced a proposal that would dismantle the Public Company Accounting Oversight Board (PCAOB). If enacted, the legislation would fold the PCAOB’s responsibilities into the Securities and Exchange Commission (SEC), prompting fears about the long-term stability of financial market oversight. The proposal has ignited a heated debate, with PCAOB Chair Erica Williams leading the charge against it, warning that the change could cause significant disruptions.

In this piece, Norman Marks addresses the evolving role of internal auditing in the face of rapid technological advancements, shifting business dynamics, and emerging risks. He challenges the profession to adapt, offering a pragmatic perspective on what auditors need to focus on today to remain valuable in the future.

Over the years, the term Integrated Risk Management (IRM) has increasingly become a focal point in discussions around governance, risk management, and compliance (GRC). While IRM gained limited traction in some circles, it’s important to remember that the concept of GRC is deeply rooted in a decades-long evolution, beginning with early work in risk management, compliance, and IT security. To understand where IRM fits, it's crucial to first understand how GRC came to be and why it continues to play a central role in managing risk and uncertainty to organizational objectives while ensuring integrity in organizations today.

In the vast and sprawling digital landscape, where our lives are lived in bits and bytes, we often forget how much of our personal data is at risk, until something shatters that illusion of safety. In the early months of 2025, that illusion was pierced when a massive data breach at X (formerly Twitter) exposed over 200 million user records. Names, email addresses, screennames, user IDs, and profile images, fragments of millions of lives, were laid bare for anyone to see.

Europe has been quietly re-engineering the rules of resilience. A few years ago, the Critical Entities Resilience Directive (CER) officially entered into force, marking a watershed moment for how the EU approaches the safeguarding of essential services across borders and sectors.

The UK government’s plan to modernize its cyber defenses isn’t just another legislative checkbox. It’s a pointed response to a threat that’s evolving faster than policy typically can. With ransomware attacks delaying over 11,000 NHS appointments last year and state-sponsored actors regularly probing UK infrastructure, the forthcoming Cyber Security and Resilience Bill is just trying to catch up.

Picture this, it’s 2024, and the EU has just dropped a new bombshell in the world of cybersecurity. It’s called the NIS2 Directive, and while its name might not scream "party," it’s definitely something organizations need to pay attention to. For all the tech nerds and cybersecurity folks out there, this is more than just a new set of rules—it's a whole new way of doing business when it comes to securing networks, reporting incidents, and managing risk. But don’t worry, this article isn’t going to sound like it was written by a robot (unless, of course, that robot had an excellent sense of humor and personality). We’re diving into what NIS2 means, how it impacts AI, and what exactly you should be doing to stay ahead of the game. And spoilers, AI is going to be your best friend in this one.