Compliance Theater Is Hiding Your Biggest Security Risks

 

Consider an illustrative scenario, a composite of patterns that repeat across security programs. A payments processor presents its quarterly security report to the audit committee. Every scheduled vulnerability scan ran on time. Nearly all employees finished security training, the certification renewed without a gap, and every audit finding from the prior year is closed. Three weeks later an attacker enters through a server that never appeared on a scan target list, because the team built it after the list was last updated. The report was accurate on every line, and it still told the committee nothing about whether the company was getting safer.

Compliance is a byproduct of security. When an organization knows its threats, protects the assets that matter, tests its controls, and fixes weaknesses until a retest confirms the fix, most of its compliance evidence becomes a record of work already done to reduce risk. When the sequence runs the other way, the organization collects evidence first and hopes protection follows. That gap is where false confidence grows, and decision-makers stop asking hard questions at the moment they most need to ask them. This article is for CISOs and compliance officers who want to report outcomes instead of activity, and it ends with seven metrics you can start swapping in this quarter.

The argument covers the obligations most teams already carry. GDPR, NIS2, HIPAA, SOX, PCI DSS, ISO/IEC 27001, and SOC 2 each ask, in different words, whether controls work and whether you can show it. Compliance stays a legal and contractual duty with its own deadlines, and nothing here argues for skipping it. The point concerns order and evidence. Security work comes first, and the records that work produces earn the compliance claim. The sections below cover what each obligation requires, how checkbox reporting goes wrong, which metrics replace it, and how to make the evidence trail a normal output of operations.

 

Guide for Risk Managers for DORA Compliance

 

A quarterly operational risk report that takes four months to produce is already a DORA problem, and nobody has opened the regulation yet. By the time the report lands, two newer quarters of incidents, supplier changes and control failures have happened. The Digital Operational Resilience Act, Regulation (EU) 2022/2554, has applied since 17 January 2025, so the open question for most financial entities is no longer when to start. The question is whether their data, owners and processes can answer a supervisor within hours instead of months.

The short answer is to build one maintained dependency model that links each critical or important function to its information, ICT assets, providers, contracts, incidents and test results, and then run the five DORA chapters on top of it. The chapters cover ICT risk management, incident management and reporting, resilience testing, ICT third-party risk, and information sharing. Most of the effort sits in the links between those chapters. A firm that treats them as five projects ends up with five registers that disagree with each other.

This guide is for risk owners, compliance officers, internal auditors and security leads who have to turn the regulation into working procedures. It follows the order in which a program usually runs, and it separates what the regulation requires from what is a sensible implementation choice. It also corrects several statements that circulate in conference slides and vendor material, such as the idea that DORA requires threat-led penetration testing from every firm.

 

How to Plan, Govern, and Build Enterprise AI Agents and AI Architecture

 

AI governance professionals need more than policies. They need to understand how AI systems are designed, where controls belong, and what happens when agents act in the real world.

An AI pilot can look impressive in a demonstration and still fail when a company tries to put it into production. Costs grow, permissions become difficult to manage, outputs vary, and nobody knows exactly who should intervene when something goes wrong.

For risk managers, internal auditors, compliance officers, cybersecurity experts, and IT professionals, these are not abstract technology problems. They are questions of accountability, control design, operational resilience, and business value.

That is why I believe AI architecture deserves a place at the center of enterprise AI governance.

 

Essential Skills for GRC, Finance, Legal and Cyber in 2027 and 2028

This article answers one worry: if AI now drafts the policies, tests the controls, reviews the contracts and triages the alerts, what is left for a GRC, finance, legal or cyber professional to do? The answer is five human skills, ranked by how well they protect your job: professional judgment (called taste in the AI community), agency, follow-through, focus and resourcefulness. Each one sits where automation stops and accountability starts. Judgment decides which AI output is sound and defensible. Agency moves you from the person who samples 40 payments to the person who runs the agent that checks all 18,000. Follow-through makes the work land with the people who rely on it. Focus keeps you on the few exposures that matter, and resourcefulness lets you take on the unfamiliar projects others decline.

The key advice is to build these skills on one real project instead of reading about them. Pick one control you test by sampling today, write the decision it supports and who makes it, and run an agent across the whole population. Write down the rules you used to sort real exceptions from noise, because that is your judgment on paper. Keep humans on irreversible decisions, give every agent an owner, a boundary and a log, and stay with the work until the business actually uses it. Revisit the projects you ruled out, since the constraint that stopped them may be gone. Employers will pay for the professional who can show the exposure chosen, the decision supported and the person who relies on the result.

Consider a composite situation, not a real engagement. An internal auditor at a mid-sized manufacturer spends two weeks every quarter testing a sample of 40 payments out of roughly 18,000 for duplicates and approval breaches. That sample covers about 0.2 percent of the population, and everyone in the room knows it. An AI agent can now read all 18,000 payments overnight and hand the auditor a short list of exceptions by Monday morning. The two weeks of sampling are gone, and so is the part of the job that looked like work.

The question for 2027 and 2028 is what the auditor does with the other thirteen days. The short answer is five human skills, and I rank them here by how well they protect a GRC, finance, legal or cybersecurity career from displacement by automation of repetitive analysis, reporting and control reviews. In order of job-market relevance they are professional judgment, agency, follow-through, focus and resourcefulness. This article is for risk analysts, internal and external auditors, compliance officers, finance controllers, in-house lawyers and security engineers who want to know which habits employers will pay for once everyone has the same AI tools.

AI has removed the old excuses that kept capable professionals from acting on what they already understood: no time, no access, no technical skill. That makes the call to action simple. Revisit the projects you ruled out in the last three years, because the constraint that ruled them out may no longer exist. AI has expanded what is possible in risk management, auditing, compliance, cybersecurity, legal work and finance faster than most people have expanded what they are willing to attempt, and that gap is where your next promotion sits.

Agentic AI in Internal Audit, What to Automate, What to Keep

 

Consider an illustrative scenario, not a real engagement. A mid-sized distributor connects an audit agent to its ERP, its document repository and its ticketing tool. Within a week the agent has pulled invoices, receipts and approvals for 240 purchase orders and produced a tidy memo saying the procure-to-pay control passed. The audit manager reads it, likes it, and asks the only question that matters: which records did the agent open? Nobody can answer.

The short answer to the sequencing problem is this. Agentic AI should first take bounded, repeatable, evidence-based work: a finite set of documents, stable rules, and output you can check against a known result. It must not decide audit scope, judge whether evidence is sufficient, conclude that a control works, rate a finding, or close an issue. Those decisions belong to accountable auditors, and an agent can only prepare the ground for them.

This article is for internal auditors, chief audit executives and the managers and audit committee members who oversee them. After reading it you will be able to sort audit tasks into automate now, automate with review gates, and keep human. You will also have a short list of access rules, evidence requirements and escalation triggers to put in place before any agent touches a workpaper. The question to ask is not whether AI can replace internal auditors. Ask which audit activities are bounded enough to automate safely, and which decisions need independent professional judgment and a named person who answers for them.

 

SOX Controls Over AI

Consider a composite situation, not a real engagement. A controller opens the monthly bank reconciliation, and the matching tool shows 1,250 unmatched items out of 18,400 bank lines. The accounting manager reviewed every item and approved the package. The external auditor asks which version of the matching logic produced that list, whether the bank file was complete when the tool ran, and what the reviewer saw on screen. Nobody can answer. The matching feature arrived in an ERP update that the supplier switched on, and the SOX risk and control matrix still describes a spreadsheet.

If AI influences financial reporting, your organization must be able to show five things: where the AI is used, how it works, that its inputs and outputs are reliable, that changes to it are controlled, and that a human exercised oversight and left evidence of it. Each of those five becomes an auditor question, and this article takes them in the order a SOX program would address them. Treat the five questions as a practical synthesis of current auditor concerns. No official PCAOB or SEC checklist with five questions exists, and I would be wary of anyone who presents one. The article is written for controllers, SOX control owners, and internal auditors who need working answers before fieldwork starts.

You do not need a separate AI compliance program to get there. COSO released guidance on internal control over generative AI in February 2026 that applies its Internal Control Integrated Framework to generative AI, and it names the risks that matter most to financial reporting: prompt-based manipulation, opaque reasoning, model drift, and frequent configuration changes. SEC staff remarks at the December 2025 AICPA and CIMA conference, as summarized in an EY compendium, pointed the same way, with attention on model design, data, human oversight, and the way AI changes IT general controls. What follows turns that direction into an inventory, a control narrative standard, a validation plan, a change register, and a failure path you can build this quarter.