News, analysis, and guidance across GRC, risk, audit, and regulatory compliance.
Regulatory Obligations ManagementWhen the Financial Reporting Council revised two standards in late 2024, many audit teams overlooked the changes. However, if your team works with external consultants on audits or coordinates with ex
Ethics & ConductThe Justice Department s National Fraud Division has published its prosecution criteria. While the Corporate Enforcement Policy remains unchanged, the memo clarifies which fraud schemes will attract f
Regulatory Obligations ManagementESMA s proposed MiCA revisions demand immediate attention from third-party risk managers. If your organization engages with crypto-asset service providers, you need a structured way to evaluate whethe
Ethics & ConductThe Conventional Wisdom At compliance conferences, you ll often hear: We need to prove compliance drives business value. Practitioners focus on ROI calculators and competitive advantage arguments. The
Get weekly security insights and compliance updates delivered to your inbox.
Privacy & Data ProtectionCalifornia s SB 923, effective January 1, 2027, expands CCPA deletion obligations to cover personal data regardless of who originally collected it. This isn t just another compliance checkbox. It s a
Regulatory Obligations ManagementThe Challenge OTC Link LLC, a broker-dealer registered with the SEC since 2012, faced allegations of repeatedly failing to establish and enforce adequate compliance policies and procedures for OTC Lin
Third-Party Risk ManagementThe European Supervisory Authorities Autumn 2026 risk update has exposed vulnerabilities that many GRC leaders thought they d already addressed. The findings reveal a gap between what financial instit
Disclosure & Financial ReportingWhat Happened On June 9, the SEC s Division of Examinations published a risk alert that changes the compliance landscape for investment advisers. The alert highlights five recurring deficiency pattern
Regulatory Obligations ManagementWhen your marketing team sends you a draft campaign featuring a climate-friendly product claim, your first question shouldn t be whether it s aspirational. It should be whether you can defend it in co
Regulatory Obligations ManagementThe SEC s Division of Enforcement, led by David Woodcock, is prioritizing aggressive fraud enforcement. For compliance officers, this isn t just a policy shift, it s a call to scrutinize your fraud de
Ethics & ConductYour whistleblower hotline is live. Complaints arrive. Then what? If you re like the Department of Homeland Security (DHS), those complaints might sit in a queue for years while investigators scramble
Third-Party Risk ManagementScope This guide shows you how to build a third-party risk management program that satisfies SS2/21, PS26/2, DORA, and the EBA Guidelines on ICT and security risk management. It s tailored for financi
Third-Party Risk ManagementThe question at hand The PRA and FCA have introduced new third-party risk management rules, effective by March 2027, sparking a debate: how much of your TPRM program should rely on automation versus h
Privacy & Data ProtectionThe Challenge Manufacturers and sellers of digital products in the EU now face a strict deadline: report all exploited vulnerabilities and severe security incidents within 24 hours of discovery. This
Regulatory Obligations ManagementWhen the DOJ s corporate FCPA enforcement page shows just one action in 2026, you might be tempted to relax your anti-corruption controls. That s a mistake. Misreading enforcement trends as risk trend
Internal Controls & AuditThe SEC s Division of Examinations has issued a warning to investment advisers: your annual compliance reviews aren t up to par. The division s latest risk alert highlights six specific failures acros
Privacy & Data ProtectionYou re evaluating how to classify and protect medical information in your data processing register . This decision is critical. Grindr recently agreed to a £26 million ($35.2 million) settlement over
GRC Platforms & AutomationWhen the OCC, FDIC, and Federal Reserve revised their model risk guidance on April 17, 2026, they excluded generative and agentic AI from its scope. This shift places the responsibility on your team t
Regulatory Obligations ManagementThese questions come from compliance officers, GRC directors, and legal teams who ve been closely monitoring constitutional challenges to the False Claims Act s qui tam provisions in federal courts. T
Regulatory Obligations ManagementHealthcare organizations often repeat the same third-party risk management mistakes, even as regulators demand more robust vendor oversight. These aren t mere oversights; they re structural issues roo
