News, analysis, and guidance across GRC, risk, audit, and regulatory compliance.
Disclosure & Financial ReportingWhat Happened On June 9, the SEC s Division of Examinations published a risk alert that changes the compliance landscape for investment advisers. The alert highlights five recurring deficiency pattern
Regulatory Obligations ManagementWhen your marketing team sends you a draft campaign featuring a climate-friendly product claim, your first question shouldn t be whether it s aspirational. It should be whether you can defend it in co
Regulatory Obligations ManagementThe SEC s Division of Enforcement, led by David Woodcock, is prioritizing aggressive fraud enforcement. For compliance officers, this isn t just a policy shift, it s a call to scrutinize your fraud de
Ethics & ConductYour whistleblower hotline is live. Complaints arrive. Then what? If you re like the Department of Homeland Security (DHS), those complaints might sit in a queue for years while investigators scramble
Get weekly security insights and compliance updates delivered to your inbox.
Third-Party Risk ManagementScope This guide shows you how to build a third-party risk management program that satisfies SS2/21, PS26/2, DORA, and the EBA Guidelines on ICT and security risk management. It s tailored for financi
Third-Party Risk ManagementThe question at hand The PRA and FCA have introduced new third-party risk management rules, effective by March 2027, sparking a debate: how much of your TPRM program should rely on automation versus h
Privacy & Data ProtectionThe Challenge Manufacturers and sellers of digital products in the EU now face a strict deadline: report all exploited vulnerabilities and severe security incidents within 24 hours of discovery. This
Regulatory Obligations ManagementWhen the DOJ s corporate FCPA enforcement page shows just one action in 2026, you might be tempted to relax your anti-corruption controls. That s a mistake. Misreading enforcement trends as risk trend
Internal Controls & AuditThe SEC s Division of Examinations has issued a warning to investment advisers: your annual compliance reviews aren t up to par. The division s latest risk alert highlights six specific failures acros
Privacy & Data ProtectionYou re evaluating how to classify and protect medical information in your data processing register . This decision is critical. Grindr recently agreed to a £26 million ($35.2 million) settlement over
GRC Platforms & AutomationWhen the OCC, FDIC, and Federal Reserve revised their model risk guidance on April 17, 2026, they excluded generative and agentic AI from its scope. This shift places the responsibility on your team t
Regulatory Obligations ManagementThese questions come from compliance officers, GRC directors, and legal teams who ve been closely monitoring constitutional challenges to the False Claims Act s qui tam provisions in federal courts. T
Regulatory Obligations ManagementHealthcare organizations often repeat the same third-party risk management mistakes, even as regulators demand more robust vendor oversight. These aren t mere oversights; they re structural issues roo
Internal Controls & AuditThe Conventional Wisdom The compliance community is celebrating the PCAOB s revisions to QC 1000 as a win for audit firms. The narrative goes like this: rigid standards create unnecessary costs, and b
Regulatory Obligations ManagementWhen the Federal Reserve Board entered into a Written Agreement with a bank holding company on August 14, 2026, the action itself was unremarkable. What matters is the pattern it confirms: holding com
Disclosure & Financial ReportingWhen a regulatory framework update comes with a 28-month implementation window, it s not a typical incident. But for compliance officers managing disclosure programs under the Prospectus Regulation ,
Regulatory Obligations ManagementThe Securities and Exchange Commission (SEC) and the Commodity Futures Trading Commission (CFTC) have extended the compliance deadline for amended Form PF reporting requirements from October 1, 2026,
Privacy & Data ProtectionUber s €825 million fine from the Dutch data protection authority isn t just a headline. It s a warning that automated decision-making systems affecting employment, access, or benefits now carry signi
Regulatory Obligations ManagementIllinois incorporated disparate impact into its state lending law the same month a New Jersey federal court blocked a bank s early exit from a redlining consent order. Meanwhile, the CFPB , HUD , and
Third-Party Risk ManagementThird-party risk teams are testing AI tools right now. Some are seeing real time savings. Others find their AI-powered platform can t answer basic questions about vendor documentation. The issue isn t
