Guide for Risk Managers for DORA Compliance

 

A quarterly operational risk report that takes four months to produce is already a DORA problem, and nobody has opened the regulation yet. By the time the report lands, two newer quarters of incidents, supplier changes and control failures have happened. The Digital Operational Resilience Act, Regulation (EU) 2022/2554, has applied since 17 January 2025, so the open question for most financial entities is no longer when to start. The question is whether their data, owners and processes can answer a supervisor within hours instead of months.

The short answer is to build one maintained dependency model that links each critical or important function to its information, ICT assets, providers, contracts, incidents and test results, and then run the five DORA chapters on top of it. The chapters cover ICT risk management, incident management and reporting, resilience testing, ICT third-party risk, and information sharing. Most of the effort sits in the links between those chapters. A firm that treats them as five projects ends up with five registers that disagree with each other.

This guide is for risk owners, compliance officers, internal auditors and security leads who have to turn the regulation into working procedures. It follows the order in which a program usually runs, and it separates what the regulation requires from what is a sensible implementation choice. It also corrects several statements that circulate in conference slides and vendor material, such as the idea that DORA requires threat-led penetration testing from every firm.

 

How to Plan, Govern, and Build Enterprise AI Agents and AI Architecture

 

AI governance professionals need more than policies. They need to understand how AI systems are designed, where controls belong, and what happens when agents act in the real world.

An AI pilot can look impressive in a demonstration and still fail when a company tries to put it into production. Costs grow, permissions become difficult to manage, outputs vary, and nobody knows exactly who should intervene when something goes wrong.

For risk managers, internal auditors, compliance officers, cybersecurity experts, and IT professionals, these are not abstract technology problems. They are questions of accountability, control design, operational resilience, and business value.

That is why I believe AI architecture deserves a place at the center of enterprise AI governance.

 

Essential Skills for GRC, Finance, Legal and Cyber in 2027 and 2028

This article answers one worry: if AI now drafts the policies, tests the controls, reviews the contracts and triages the alerts, what is left for a GRC, finance, legal or cyber professional to do? The answer is five human skills, ranked by how well they protect your job: professional judgment (called taste in the AI community), agency, follow-through, focus and resourcefulness. Each one sits where automation stops and accountability starts. Judgment decides which AI output is sound and defensible. Agency moves you from the person who samples 40 payments to the person who runs the agent that checks all 18,000. Follow-through makes the work land with the people who rely on it. Focus keeps you on the few exposures that matter, and resourcefulness lets you take on the unfamiliar projects others decline.

The key advice is to build these skills on one real project instead of reading about them. Pick one control you test by sampling today, write the decision it supports and who makes it, and run an agent across the whole population. Write down the rules you used to sort real exceptions from noise, because that is your judgment on paper. Keep humans on irreversible decisions, give every agent an owner, a boundary and a log, and stay with the work until the business actually uses it. Revisit the projects you ruled out, since the constraint that stopped them may be gone. Employers will pay for the professional who can show the exposure chosen, the decision supported and the person who relies on the result.

Consider a composite situation, not a real engagement. An internal auditor at a mid-sized manufacturer spends two weeks every quarter testing a sample of 40 payments out of roughly 18,000 for duplicates and approval breaches. That sample covers about 0.2 percent of the population, and everyone in the room knows it. An AI agent can now read all 18,000 payments overnight and hand the auditor a short list of exceptions by Monday morning. The two weeks of sampling are gone, and so is the part of the job that looked like work.

The question for 2027 and 2028 is what the auditor does with the other thirteen days. The short answer is five human skills, and I rank them here by how well they protect a GRC, finance, legal or cybersecurity career from displacement by automation of repetitive analysis, reporting and control reviews. In order of job-market relevance they are professional judgment, agency, follow-through, focus and resourcefulness. This article is for risk analysts, internal and external auditors, compliance officers, finance controllers, in-house lawyers and security engineers who want to know which habits employers will pay for once everyone has the same AI tools.

AI has removed the old excuses that kept capable professionals from acting on what they already understood: no time, no access, no technical skill. That makes the call to action simple. Revisit the projects you ruled out in the last three years, because the constraint that ruled them out may no longer exist. AI has expanded what is possible in risk management, auditing, compliance, cybersecurity, legal work and finance faster than most people have expanded what they are willing to attempt, and that gap is where your next promotion sits.

Agentic AI in Internal Audit, What to Automate, What to Keep

 

Consider an illustrative scenario, not a real engagement. A mid-sized distributor connects an audit agent to its ERP, its document repository and its ticketing tool. Within a week the agent has pulled invoices, receipts and approvals for 240 purchase orders and produced a tidy memo saying the procure-to-pay control passed. The audit manager reads it, likes it, and asks the only question that matters: which records did the agent open? Nobody can answer.

The short answer to the sequencing problem is this. Agentic AI should first take bounded, repeatable, evidence-based work: a finite set of documents, stable rules, and output you can check against a known result. It must not decide audit scope, judge whether evidence is sufficient, conclude that a control works, rate a finding, or close an issue. Those decisions belong to accountable auditors, and an agent can only prepare the ground for them.

This article is for internal auditors, chief audit executives and the managers and audit committee members who oversee them. After reading it you will be able to sort audit tasks into automate now, automate with review gates, and keep human. You will also have a short list of access rules, evidence requirements and escalation triggers to put in place before any agent touches a workpaper. The question to ask is not whether AI can replace internal auditors. Ask which audit activities are bounded enough to automate safely, and which decisions need independent professional judgment and a named person who answers for them.

 

SOX Controls Over AI

Consider a composite situation, not a real engagement. A controller opens the monthly bank reconciliation, and the matching tool shows 1,250 unmatched items out of 18,400 bank lines. The accounting manager reviewed every item and approved the package. The external auditor asks which version of the matching logic produced that list, whether the bank file was complete when the tool ran, and what the reviewer saw on screen. Nobody can answer. The matching feature arrived in an ERP update that the supplier switched on, and the SOX risk and control matrix still describes a spreadsheet.

If AI influences financial reporting, your organization must be able to show five things: where the AI is used, how it works, that its inputs and outputs are reliable, that changes to it are controlled, and that a human exercised oversight and left evidence of it. Each of those five becomes an auditor question, and this article takes them in the order a SOX program would address them. Treat the five questions as a practical synthesis of current auditor concerns. No official PCAOB or SEC checklist with five questions exists, and I would be wary of anyone who presents one. The article is written for controllers, SOX control owners, and internal auditors who need working answers before fieldwork starts.

You do not need a separate AI compliance program to get there. COSO released guidance on internal control over generative AI in February 2026 that applies its Internal Control Integrated Framework to generative AI, and it names the risks that matter most to financial reporting: prompt-based manipulation, opaque reasoning, model drift, and frequent configuration changes. SEC staff remarks at the December 2025 AICPA and CIMA conference, as summarized in an EY compendium, pointed the same way, with attention on model design, data, human oversight, and the way AI changes IT general controls. What follows turns that direction into an inventory, a control narrative standard, a validation plan, a change register, and a failure path you can build this quarter.

 

AI Governance Frameworks For Risk Managers

 

Corporate environments are adopting autonomous systems at a pace that outstrips traditional oversight mechanisms. Engineering teams ship automated workflows daily. Business units integrate external models into core operations without formal review. The resulting environment creates massive blind spots for risk professionals. You cannot manage what you cannot see, and you certainly cannot audit what you do not understand. The era of treating artificial intelligence as a mere productivity enhancement is over. It is now a foundational component of enterprise architecture. This shift demands a complete rethinking of control environments.

Risk managers, compliance officers, and cybersecurity experts must transition from passive observers to active architects of machine behavior. The theoretical debates about future capabilities no longer matter. The immediate reality involves managing current deployments that process sensitive data, execute financial transactions, and interact directly with customers. Professionals who master this transition will define the next decade of corporate governance. Those who fail will preside over catastrophic compliance failures and severe reputational damage.

This guide provides a direct, actionable blueprint for securing autonomous systems. We will explore five essential pillars of modern risk management. These pillars move beyond basic policy documents. They focus on the practical implementation of controls, the integration of global standards, and the strategic career positioning of governance leaders. You will learn how to validate machine outputs, secure third-party integrations, assign legal accountability, capture institutional context, and manage the hidden costs of automated code generation.

AI Agent Segregation of Duties Guide for GRC and SOX Compliance

 

Finance leaders are under constant pressure to cut costs, and automation is the fastest lever available. IT teams are asked to hand AI agents more autonomy every quarter, and in many workflows that autonomy now stretches across the full transaction lifecycle: an agent reads customer or financial data, produces a recommendation, approves it, executes the action through an API, and writes the log entry that documents what happened.

No serious organization would hand a single employee that combination of powers without a control wrapped around every step. Yet that is precisely the architecture some companies are building today, one agent deployment at a time, often without anyone deciding to do so on purpose. This piece walks through why that pattern is a genuine segregation of duties problem, what Sarbanes-Oxley actually requires when an agent touches a financially relevant process, and what a control owner can do about it in practice.

The Risk Management Blueprint: A Practitioner's Guide to Quantitative GRC

 

Risk management has a credibility problem. Not because the profession lacks talent, but because color-coded heat maps, ordinal scoring matrices, and quarterly dashboard reviews were never built to change decisions. They exist to document that a compliance process took place. Executive teams know this. They react accordingly by treating risk departments as corporate overhead instead of strategic assets.

I wrote this book to help my peers turn that dynamic around.

After 25 years leading risk functions and advising executive boards across complex multinational companies, I needed a manual that actually bridges advanced quantitative methods with the daily decisions that determine business outcomes. That drive is why The Risk Management Blueprint hit #9 among the most sold risk management books in the weeks after publishing.

At 867 pages, it gives practitioners a single unified methodology across every major risk domain, covering AI systems, cyber exposure, financial cash flows, sustainability transitions, and human behavior. The framework rests on probability theory, financial modeling, and decision science so you can swap subjective scores for numbers that stand up in the boardroom.

You can preview the first four chapters and access the book here: https://amzn.to/4ciag1F

This is not a textbook. It does not spend the majority of its pages diagnosing what is broken in the profession before gesturing toward improvement in a final chapter. More than 70 percent of the book's total length is allocated to domain applications and advanced analytical infrastructure, meaning the bulk of every page is spent on how to build, calibrate, and apply quantitative and predictive risk models across the decisions that actually shape organizational outcomes.

SOC 2 Is Not Security: A Critical Guide for GRC Managers

Let us be direct. SOC 2 is not a security certification. It is an attestation report issued under AICPA standards in which a licensed public accounting firm expresses an opinion on whether a service organization controls met the selected trust services criteria. The report does not declare that your product is safe. It does not certify that your penetration test was rigorous. It does not prove that your attack surface is small or that your customers are protected from a breach. It states that management described a system, selected criteria, asserted controls, and the auditor found those controls suitably designed and, for a Type II report, operating effectively during the specified period.

That distinction matters more than many teams are willing to admit. The report can create a polished artifact that procurement teams accept, but the underlying controls may still be thin, poorly scoped, or disconnected from the technical reality of the product. The phrase SOC 2 is the audit version of trust me bro became popular for a reason. When the PDF is stronger than the security program, the market starts rewarding documentation rather than operational resilience. As a GRC leader, your job is to reverse that sequence. Build the controls, operate them, collect evidence continuously, and let the SOC 2 report fall out as a byproduct rather than serving as the starting point.

This guide walks through the exact gaps that make SOC 2 incomplete as a security signal, how to read a report without wasting your review cycle, how to build a security-first program that makes SOC 2 the output, how to use continuous assurance strategically, and how to govern vendors that hand you a SOC 2 report and expect instant approval. The focus is practical because the risk owner in the room rarely needs another abstract debate. You need a method for using SOC 2 as one piece of evidence among many.

The article is intended for a global audience. SOC 2 is a US-origin AICPA attestation product, but it is now exchanged across borders by cloud providers, software vendors, data processors, and AI product teams. It often sits alongside ISO/IEC 27001, NIST Cybersecurity Framework, CIS Controls, GDPR, HIPAA, NIS2, and emerging AI governance obligations. That means the underlying discipline remains the same. Understand the limitations, own the controls, and never outsource your risk judgment to a report.

 

The Quantitative Revolution In Enterprise Risk Management

Traditional risk management has reached an inflection point where intuition and qualitative heat maps no longer suffice for navigating complex, interconnected business environments. The modern governance, risk, and compliance director faces a paradox: organizations generate more data than ever before, yet decision makers remain plagued by uncertainty about the very risks that could derail strategic objectives. This gap between information availability and decision quality stems from reliance on uncalibrated expert judgment, measurement of irrelevant variables, and risk models that violate fundamental mathematical principles. The solution lies not in abandoning human expertise, but in rigorously calibrating it through quantitative methods that transform subjective opinions into defensible, mathematically sound probability assessments.

Organizations that master these quantitative techniques gain a decisive competitive advantage. They allocate capital more efficiently by focusing measurement budgets on variables that actually influence decisions. They avoid catastrophic failures by identifying cascade risks and common-mode vulnerabilities before they materialize. They build organizational resilience through models that reflect physical reality rather than statistical convenience. This transformation requires risk professionals to develop new competencies in probability theory, information economics, and computational modeling. The following techniques represent the distilled wisdom of decades of research in decision science, behavioral economics, and quantitative risk analysis. Each method addresses a specific failure mode in traditional risk management, providing practical tools that GRC directors can implement immediately to elevate their organization's risk maturity from descriptive to predictive to prescriptive.

Machine Learning Predictive Risk Modeling for GRC Professionals

AI Use Cases for Risk Management

Machine learning fundamentally transforms risk management from a reactive, sample based discipline into a proactive, population wide surveillance system. The traditional operational model, where risk professionals manually review periodic samples, apply static heuristic rules, and generate retrospective reports, cannot scale to match the velocity, volume, and complexity of modern business transactions. Machine learning enabled systems continuously monitor entire populations of transactions, access requests, supplier relationships, and control events. These systems identify subtle patterns and emerging risks that consistently escape rigid rule based systems. This paradigm shift does not eliminate the need for human expertise. Rather, it repositions risk professionals from data processors to strategic decision makers who focus their judgment on exceptional cases, ambiguous signals, and high consequence approvals. Organizations that successfully implement this model achieve what was previously impossible. They gain comprehensive risk visibility without proportional increases in headcount, enabling the risk function to scale with business growth rather than becoming an operational bottleneck.

The integration of machine learning into governance, risk, and compliance frameworks aligns directly with the core principles of ISO 31000, which emphasizes that risk management must be dynamic, iterative, and responsive to change. Static controls are inherently blind to novel threats and evolving business environments. By embedding predictive analytics into the risk management lifecycle, organizations transition from merely documenting historical failures to actively preventing future exposures. This requires a fundamental rethinking of the risk operating model. The strongest operating model does not seek to replace the risk professional. Instead, it automates the predictable, prioritizes the unusual, and reserves human judgment for material, ambiguous, or consequential decisions. This symbiotic relationship between human expertise and machine scale forms the foundation of modern, resilient risk management.

  

Hiring a Chief Risk Officer: The Interview Questions That Reveal Judgment (With Good and Bad Answers)

Chief Risk Officer hires fail quietly. Not on day one. Not even in the first six months. They fail around month fourteen, when the board and the executive team realise the person they hired can build a risk report but cannot challenge a portfolio manager who is technically within limits but building a position that could unravel the firm.

That is a very expensive lesson.

This guide covers the full hiring process, from mandate definition through structured interviewing to onboarding. It includes specific questions, what good answers look like, and what weak answers reveal. The goal is to help you hire a CRO who makes the firm better at taking risk intelligently, not just one who documents it carefully.

 

Stop Chasing Evidence to Start Informing Decision-Making

Walk into most GRC departments in large global companies and you'll find talented professionals spending their weeks on the same treadmill: updating a register, chasing a control owner for evidence, formatting a report nobody outside compliance will read. That work isn't worthless, audits need it and regulators expect it, but it has quietly become the entire job for a lot of practitioners, and that's a problem nobody in the function wants to say out loud. Paper compliance was built for a slower, less automated world. The world asking for your risk function’s input now needs something else: probabilistic insight that turns uncertainty into measurable exposure, decision thresholds, planning choices, and control responses that improve performance.

uncertainty → exposure → thresholds → decisions → treatment actions → performance 

 

AI Isn't Coming for GRC Jobs. It's Coming For The Manual Review Part of Every GRC Job

Here's the uncomfortable part nobody says out loud in a GRC conference room. AI is not replacing risk managers, compliance officers, auditors, cyber teams, controllers, or sustainability experts. It's replacing the manual review work that used to justify half of those job descriptions. What's left after that work disappears is judgment, and judgment is either your biggest career asset right now or the skill you never actually built because the manual work always came first.

Every one of these six professions is being pulled through the same transformation at the same time, just wearing different clothes. Risk teams are using AI to process larger volumes of exposure data faster than any analyst could by hand. Audit is automating the routine testing that used to eat most of fieldwork season. Cyber teams are automating alert triage and first-line response. Compliance is watching AI surface policy conflicts across thousands of documents in the time it used to take to review one contract. Controllers are automating reconciliations and close procedures. Sustainability teams are automating ESG data extraction and disclosure drafting.

None of that is a headcount story on its own. It becomes one for the people who don't adapt, because the professionals who can validate AI outputs, challenge exceptions, and decide where a human still has to sign off are becoming the only ones a board actually needs in the room.

 

Probability Is Not Intuition, A Quantitative Risk Framework Every Risk Manager Must Own

 

A risk manager approved a scenario analysis The model showed a 3% probability of simultaneous credit default and operational system failure. The number felt conservative. The model was wrong. The analyst had multiplied two standalone probabilities together without checking whether the events were independent. They were not. The actual joint probability was nearly four times higher.

This is not an exotic failure. It happens in credit committees, insurance pricing teams, and capital adequacy reviews every week. The underlying error is always the same: treating probability concepts as interchangeable when they are structurally distinct.

The most expensive probability errors in risk management are not computational. They are conceptual. Using an unconditional probability where a conditional one is required, or assuming independence without testing it, can produce capital estimates that understate tail risk by multiples, not percentages.

 

S/4HANA Role Redesign: Fix Segregation of Duties Before Go-Live or Pay the Audit Bill After

 

Why Privilege Creep Kills SAP Migrations Before the First Production Transaction Runs

Your migration to SAP S/4HANA is six months out. The project team is focused on data migration, Fiori tile configuration, and cutover planning. Meanwhile, 847 user roles built across eight years of organizational changes, job transfers, emergency firefighter access, and M&A integrations are being lifted wholesale into the new system. Nobody has reviewed them. Nobody has mapped them against the new S/4HANA authorization model. And your external auditors are already asking for the SoD conflict report.

This is the standard failure mode. And it is expensive to fix after go-live.

Migrating unremediated ECC roles into S/4HANA production does not just inherit old access risk. It amplifies it. S/4HANA's simplified data model, new Fiori authorization objects, and transaction replacements create net-new SoD conflicts from role content that was previously clean.

This article gives you the technical remediation workflow to stop that from happening. It covers the SAP-native tools, the sequencing logic, the role design architecture that prevents re-accumulation, and the automated tooling that makes the process viable at enterprise scale.

 

A Practical Field Guide for Auditing SAP HR Systems

Auditing an SAP Human Capital Management (HCM) environment is one of the most consequential engagements an internal auditor or external reviewer can undertake. Payroll errors, unauthorized access to employee records, and misconfigured benefit plans can expose an organization to financial loss, regulatory penalties, and reputational damage,  all traceable to configuration decisions buried deep in a system that most auditors never fully explore.

This guide walks you through the major audit domains in SAP HCM in a logical, field-ready sequence. For each area, you will find the specific transaction codes (T-codes) to use, the tables and objects to examine, what to look for as a potential finding, and practical recommendations you can bring back to management. Whether you are new to SAP audits or refining an existing program, this guide gives you a structured, repeatable approach that covers configuration, authorization, and reporting controls.

A note on terminology: throughout this guide, references to the IMG mean the Implementation Guide, accessed via SPRO (System Customizing Implementation Guide). The IMG is where nearly all SAP configuration lives, and access to it is itself a significant control risk. Every section will remind you to check who can get in there, because the person who can change configuration often does not need to.

 

Convolution in Monte Carlo Risk Modeling: Eliminating Structural Bias in Aggregate Loss Estimation

Risk management has evolved considerably over the past decade, yet a fundamental mathematical error continues to plague Monte Carlo simulations across industries. This error, rooted in the improper aggregation of frequency and severity distributions, systematically overestimates risk exposure by margins that frequently exceed sixty percent for common decision-making. The financial implications are staggering: organizations unknowingly lock away millions in excess reserves based on models that violate basic principles of probability theory.

The core issue lies not in the complexity of risk modeling, but in a deceptively simple mistake that appears mathematically plausible yet produces physically impossible scenarios. Understanding this error requires examining how independent random events should be combined in simulation models, and why the shortcuts employed by many software platforms fundamentally misrepresent reality.

SR 26-2 Is Here: The 2026 Model Risk Guidance That Finally Gives Validators Teeth

On April 17, 2026, the Federal Reserve, the FDIC, and the OCC (collectively, "the agencies") issued SR Letter 26-2, which replaces prior model risk management guidance, the SR 11-7 issued in 2011. This update refines supervisory expectations regarding how banking organizations should calibrate their model risk management frameworks. The guidance is most directly applicable to institutions with total assets exceeding $30 billion, though smaller institutions with complex modeling activities are advised to consider its principles.

The guidance formally excludes simple arithmetic calculations, deterministic rule-based processes, and notably, generative artificial intelligence and agentic artificial intelligence models from the definition of a model. However, the agencies explicitly state that traditional statistical, quantitative, and non-generative artificial intelligence models remain within scope. The primary audience is organizations with over $30 billion in assets, reflecting a tailored supervisory approach that recognizes the lower inherent risk profiles of most community banking institutions.

 

How to Stop Producing Risk Registers Nobody Uses

Enterprise Risk Management programs fail in the same quiet way. They produce polished registers, colorful heat maps, and quarterly reports that look impressive in board packs. Then the organization makes its next major capital allocation, acquisition, or vendor choice using a single-page summary with one projected number and zero reference to the risk framework that consumed thousands of hours to build.

I've watched this pattern destroy the credibility of risk functions across industries. The risk team works hard. Stakeholders get interviewed. Likelihood and impact get scored. And none of it touches the actual decisions that determine whether the organization wins or loses. The gap between risk reporting quality and decision quality is where ERM programs go to die.

This article addresses that gap directly. It provides a stage-by-stage implementation approach for building an ERM program that changes how your organization decides, plans, and allocates resources. Every recommendation comes from field-tested practice, not theory. If your ERM program currently produces documents that live in SharePoint between annual reviews, this post shows you how to fix that.