News, analysis, and guidance across GRC, risk, audit, and regulatory compliance.
Privacy & Data ProtectionThe California Individual Rights Act (CPRA) took effect on January 1, 2023, with enforcement starting July 1, 2023. Unlike the California Consumer Privacy Act (CCPA) it replaced, the CPRA expands cons
Privacy & Data ProtectionYou re staring at a spreadsheet with five tabs, one for each state privacy law your company needs to comply with. California wants data protection assessments. Utah doesn t. Connecticut requires unive
Third-Party Risk ManagementSanctions compliance has become a boardroom priority, yet many third-party risk programs still operate on outdated assumptions. These assumptions were formed before the Russian Federation s invasion o
Third-Party Risk ManagementIf you re aiming to comply with the EU Corporate Sustainability Due Diligence Directive (CSDD), you might think rigorous supplier audits are the solution. Conduct site visits, review policies, and che
Get weekly security insights and compliance updates delivered to your inbox.
Regulatory Obligations ManagementGermany s Supply Chain Due Diligence Act is now in full effect. The Federal Office of Economic Affairs and Export Control (BAFA) can impose fines up to eight million euros or 2% of annual global turno
Regulatory Obligations ManagementThe EU s Corporate Sustainability Due Diligence Directive (CSDDD) isn t a one-size-fits-all mandate. Your compliance path depends on three variables: where you operate, how much revenue you generate i
Privacy & Data ProtectionThe U.K. has updated its data protection rules with a new law aimed at simplifying compliance with existing privacy legislation, including GDPR . For compliance officers managing data processing regis
Business Continuity & ResilienceManchester Airports Group (MAG) managed to keep its airports operational during a ICT-Related Incident in August 2026, while attackers stole data on 8.7 million customers. Both outcomes are significan
Regulatory Obligations ManagementThe Justice Department s Criminal Division released updated compliance program guidance this week, focusing on practical questions that impact cooperation credit negotiations, declination decisions, a
Internal Controls & AuditThe Decision You re Facing Your general counsel just called. An anonymous tip alleges financial misconduct in procurement. The audit committee wants an external investigation. Someone suggests you get
Third-Party Risk ManagementWhen your Third-Party Risk Management (TPRM) program treats every vendor the same, you re either over-investing in low-risk relationships or under-managing critical ones. You need a structured way to
Ethics & ConductThe SEC received 18,354 whistleblower tips in FY2023, a 49% increase from the previous year. This isn t just a number; it s a warning that your internal reporting mechanisms might be failing. When emp
Regulatory Obligations ManagementThe U.S. Department of Health and Human Services Office of the Inspector General (OIG) has made a clear statement: compliance officers shouldn t report to legal or finance. They should report directly
Third-Party Risk ManagementThe EU s Corporate Sustainability Due Diligence Directive (CSDDD) hasn t seen its first enforcement case yet, with compliance deadlines set for 2027. However, you can anticipate potential failure mode
Ethics & ConductRethinking Noncompetes Your compliance team might view noncompete agreements as critical for safeguarding intellectual property. The reasoning seems straightforward: you ve invested in training employ
Third-Party Risk ManagementThe Securities and Exchange Commission (SEC) is sending letters to technology companies, probing their relationships with distributors, resellers, and other third parties in high-risk corruption areas
Third-Party Risk ManagementWhen Deputy Attorney General Lisa Monaco referred to sanctions enforcement as the new FCPA in summer 2022, it marked a significant shift in the DOJ s focus on economic crime. Yet, many third-party ris
Third-Party Risk ManagementThe Corporate Sustainability Due Diligence Directive (CSDDD) was formally approved by the European Council on May 24. It s a unique regulation that goes beyond typical supply chain concerns like cyber
Regulatory Obligations ManagementThe Question at Hand When the Supreme Court makes significant regulatory changes, compliance officers face a dilemma: should you adjust your program in response, or continue with your current obligati
Regulatory Obligations ManagementYou re not ignoring EU regulations. You ve assigned someone to track them, maybe even budgeted for a consultant. But if your organization treats CSRD , CSDDD , or the EU Retaliation Protection Directi
