Insights

In this reflective piece, risk management expert and author Norman Marks draws from his own leadership experience in IT and governance to explore the relationship between resilience and risk management. From disaster recovery planning to strategic decision-making, he explains why resilience, while essential, is just one tool in a much larger toolkit. Sometimes, being resilient isn’t enough. Sometimes, the smartest move is to change course altogether.

In a previous article I wrote, The “R” in GRC: What Risk Management Software Should Really Deliver, I discussed the challenges many organizations face with risk management technology—how too often, what’s marketed as “risk management” software falls short, becoming little more than digital filing cabinets that serve bureaucratic needs instead of strategic decision-making. While many risk modules excel at routing forms, assigning tasks, and storing data, they fail to provide the kind of insight necessary for meaningful risk management.

In this article, Graeme Keith dives into the limitations of traditional risk matrices and presents an alternative approach to risk management. By exploring the need for a model that better aligns with real-world decision-making, Keith highlights the shortcomings of compliance-driven exercises and offers a framework that allows businesses to better assess and prioritize risks across the enterprise.

Governance, Risk, and Compliance (GRC) is often seen as a necessary but burdensome overhead, essential for meeting regulatory demands but rarely viewed as a driver of business value. But what if that perception is holding your organization back? In a new guide titled From Overhead to Advantage: Reframing GRC Investment, we explore how GRC can shift from a passive function into a proactive strategic asset that not only ensures compliance but also accelerates growth and strengthens business resilience.

In Graeme Keith's latest article, he explores the limitations of heat maps in risk assessment and why quantitative risk analysis is essential for effective Enterprise Risk Management (ERM). By using two hypothetical risk scenarios, Keith highlights the significant gaps in traditional risk matrices and advocates for a more rational, analytical approach to risk prioritization and aggregation. Through his analysis, he emphasizes the need for a deeper understanding of risk impacts, beyond surface-level assessments.

In a recent discussion with a trusted colleague, Stefan, the Head of Risk and Governance at a major UK retail company, I was reminded of an essential lesson in governance, risk management, and compliance (GRC). This conversation, held one evening in Mayfair, focused not just on the tools and platforms available today, but on the true value of GRC, and why too many organizations miss the point. If you're looking for a deeper dive into the ROI-focused conversation that sparked this reflection, I recommend reading my article GRC Value: It’s More Than Just ROI, which explores the need to look beyond mere efficiency and towards strategic objectives.

In this article, Norman Marks explores the absence of a formal US corporate governance code, unlike those adopted in other countries such as the UK, Japan, and South Africa. Marks discusses the newly introduced COSO Corporate Governance Framework, a collaboration with the National Association of Corporate Directors (NACD) and PwC, designed to guide organizations in enhancing their governance practices. While the framework offers valuable principles across six key components, Marks highlights its limitations, particularly its lack of enforceable authority and depth compared to a full-fledged governance code. This piece delves into the implications of the framework and raises important questions about the need for a US corporate governance code.