News, analysis, and guidance across GRC, risk, audit, and regulatory compliance.
Regulatory Obligations ManagementYou re evaluating compliance software for a regional bank with 47 branches. The vendor shows you a dashboard: 94% policy attestation, 312 monitoring reviews completed, 18 open issues. You ask which br
Regulatory Obligations ManagementIn March 2023, Deputy Attorney General Lisa Monaco announced significant updates to the Department of Justice s evaluation criteria for corporate compliance programs. These changes mark a fundamental
Regulatory Obligations ManagementThe conventional wisdom Compliance officers are rushing to build AI governance programs. The logic seems solid: the DOJ s September 2024 ECCP revisions highlight AI risks, the EU AI Act sets complianc
Third-Party Risk ManagementYour vendor risk team is constantly pitched AI features that promise to transform your third-party assessments or eliminate manual reviews entirely. While these claims sound impressive in demos, they
Get weekly security insights and compliance updates delivered to your inbox.
Third-Party Risk ManagementThe Wirecard fraud wasn t a sudden explosion. It was a slow-motion collapse of every control layer that should have stopped it. By the time investigators confirmed that €1.29 billion in escrow account
Ethics & ConductWhen the SEC Office of the Whistleblower reported receiving 24,980 tips in FY 2024, compliance teams were alarmed. It seemed employees were bypassing internal channels at unprecedented rates. Then cam
Enterprise Risk ManagementYou ve been handed the risk officer role after an unexpected departure, or your board just received an exam finding that your risk management lacks formalization. Either way, you re now responsible fo
Disclosure & Financial ReportingThe Corporate ESG Reporting Directive (CSRD) expands ESG Reporting obligations to thousands of European companies starting in January 2024. If you re a GRC leader at an organization operating in or se
Regulatory Obligations ManagementOn February 2, 2025, the first five articles of the EU AI Act took effect. If your organization operates in Europe or deploys AI systems used by European entities, you re now subject to enforcement. A
Policy Lifecycle ManagementYou re managing exceptions somewhere. Credit tracks loan-to-value departures in one spreadsheet. Information security maintains risk acceptances in another. Vendor management logs contractual deviatio
Policy Lifecycle ManagementImagine you re in a conference room. Opposing counsel, a regulator, or your board asks: Show us evidence that you verified the AI output before you acted on it. What do you hand them? These questions
Third-Party Risk ManagementYour board just asked if your company is ready for the EU s Corporate Sustainability Due Diligence Directive (CSDDD). If you re a CISO or GRC leader, this is now your responsibility. Scope of This Gui
Internal Controls & AuditYour finance team just used an AI agent to draft a revenue recognition memo. Your compliance officer ran a vendor risk assessment through a large language model. Your internal audit director asked Cha
Third-Party Risk ManagementThe Court of Justice of the European Union (CJEU) has issued rulings that fundamentally change how your team must evaluate trust structures in the context of EU sanctions and anti-money laundering (AM
Regulatory Obligations ManagementThe Securities and Exchange Commission charged 38 firms with filing false information in their Forms ADV, all following an identical playbook: claim the same auditor, report nearly identical asset val
Regulatory Obligations ManagementThe AI Action Plan s focus on self-regulation shifts compliance responsibility directly to your organization. You can t wait for federal regulations to dictate what s acceptable; you need to build you
Ethics & ConductThe Conventional Wisdom You re hearing that the DOJ s expanded whistleblower rewards programs, announced May 12, 2025, for the Criminal Division and July 8, 2025, for the Antitrust Division, are a gam
Privacy & Data ProtectionYou re processing data for customers or employees in Switzerland. Your legal team asks whether you need to comply with the revised Swiss Federal Act on Data Protection (revFADP). Your GDPR program is
Privacy & Data ProtectionIreland s Data Protection Commission imposed a record €1.2 billion fine on Meta in May 2023 for transferring European Facebook user data to the United States without adequate protection from U.S. inte
Privacy & Data ProtectionYour security team just deployed an AI-powered threat detection tool. Your legal department is experimenting with a contract analysis assistant. Your customer service team wants to use a chatbot train
