News, analysis, and guidance across GRC, risk, audit, and regulatory compliance.
Disclosure & Financial ReportingThe Corporate ESG Reporting Directive (CSRD) expands ESG Reporting obligations to thousands of European companies starting in January 2024. If you re a GRC leader at an organization operating in or se
Regulatory Obligations ManagementOn February 2, 2025, the first five articles of the EU AI Act took effect. If your organization operates in Europe or deploys AI systems used by European entities, you re now subject to enforcement. A
Policy Lifecycle ManagementYou re managing exceptions somewhere. Credit tracks loan-to-value departures in one spreadsheet. Information security maintains risk acceptances in another. Vendor management logs contractual deviatio
Policy Lifecycle ManagementImagine you re in a conference room. Opposing counsel, a regulator, or your board asks: Show us evidence that you verified the AI output before you acted on it. What do you hand them? These questions
Get weekly security insights and compliance updates delivered to your inbox.
Third-Party Risk ManagementYour board just asked if your company is ready for the EU s Corporate Sustainability Due Diligence Directive (CSDDD). If you re a CISO or GRC leader, this is now your responsibility. Scope of This Gui
Internal Controls & AuditYour finance team just used an AI agent to draft a revenue recognition memo. Your compliance officer ran a vendor risk assessment through a large language model. Your internal audit director asked Cha
Third-Party Risk ManagementThe Court of Justice of the European Union (CJEU) has issued rulings that fundamentally change how your team must evaluate trust structures in the context of EU sanctions and anti-money laundering (AM
Regulatory Obligations ManagementThe Securities and Exchange Commission charged 38 firms with filing false information in their Forms ADV, all following an identical playbook: claim the same auditor, report nearly identical asset val
Regulatory Obligations ManagementThe AI Action Plan s focus on self-regulation shifts compliance responsibility directly to your organization. You can t wait for federal regulations to dictate what s acceptable; you need to build you
Ethics & ConductThe Conventional Wisdom You re hearing that the DOJ s expanded whistleblower rewards programs, announced May 12, 2025, for the Criminal Division and July 8, 2025, for the Antitrust Division, are a gam
Privacy & Data ProtectionYou re processing data for customers or employees in Switzerland. Your legal team asks whether you need to comply with the revised Swiss Federal Act on Data Protection (revFADP). Your GDPR program is
Privacy & Data ProtectionIreland s Data Protection Commission imposed a record €1.2 billion fine on Meta in May 2023 for transferring European Facebook user data to the United States without adequate protection from U.S. inte
Privacy & Data ProtectionYour security team just deployed an AI-powered threat detection tool. Your legal department is experimenting with a contract analysis assistant. Your customer service team wants to use a chatbot train
Disclosure & Financial ReportingNo public company has collapsed from Sarbanes-Oxley Act compliance in the last decade, but many have faced significant setbacks due to failures in this area. These failures often lead to restatements,
Enterprise Risk ManagementThe FDIC s proposal to raise Part 363 thresholds for the first time in 33 years has sparked relief among mid-sized banks. Fewer mandated audits and reduced audit committee requirements sound appealing
Privacy & Data ProtectionYour privacy compliance program needs to address 19 state laws and counting. If you re still managing regulatory tracking in spreadsheets and static documents, you re falling behind. This template pro
Privacy & Data ProtectionSingapore s September deadline for DPO registration sent a clear signal: regulators expect you to prove compliance readiness on demand. The Personal Data Protection Commission s notification to compan
Regulatory Obligations ManagementIf your team clears derivatives through non-EU central counterparties, you ll soon need to formalize your reporting process. ESMA s new framework requires structured annual submissions starting after
Regulatory Obligations ManagementThe 3 September 2026 deadline for ESMA s weekly commodity derivatives position reporting framework demands a technical decision you can t defer. Your organization must submit reports using XML schema
Ethics & ConductContext: Questions from the compliance team channel Since the DOJ s June 9 policy memo redefining FCPA enforcement priorities, many compliance officers have asked whether the old playbook still applie
