Agentic AI in Internal Audit, What to Automate, What to Keep

 

Consider an illustrative scenario, not a real engagement. A mid-sized distributor connects an audit agent to its ERP, its document repository and its ticketing tool. Within a week the agent has pulled invoices, receipts and approvals for 240 purchase orders and produced a tidy memo saying the procure-to-pay control passed. The audit manager reads it, likes it, and asks the only question that matters: which records did the agent open? Nobody can answer.

The short answer to the sequencing problem is this. Agentic AI should first take bounded, repeatable, evidence-based work: a finite set of documents, stable rules, and output you can check against a known result. It must not decide audit scope, judge whether evidence is sufficient, conclude that a control works, rate a finding, or close an issue. Those decisions belong to accountable auditors, and an agent can only prepare the ground for them.

This article is for internal auditors, chief audit executives and the managers and audit committee members who oversee them. After reading it you will be able to sort audit tasks into automate now, automate with review gates, and keep human. You will also have a short list of access rules, evidence requirements and escalation triggers to put in place before any agent touches a workpaper. The question to ask is not whether AI can replace internal auditors. Ask which audit activities are bounded enough to automate safely, and which decisions need independent professional judgment and a named person who answers for them.

 

SOX Controls Over AI

Consider a composite situation, not a real engagement. A controller opens the monthly bank reconciliation, and the matching tool shows 1,250 unmatched items out of 18,400 bank lines. The accounting manager reviewed every item and approved the package. The external auditor asks which version of the matching logic produced that list, whether the bank file was complete when the tool ran, and what the reviewer saw on screen. Nobody can answer. The matching feature arrived in an ERP update that the supplier switched on, and the SOX risk and control matrix still describes a spreadsheet.

If AI influences financial reporting, your organization must be able to show five things: where the AI is used, how it works, that its inputs and outputs are reliable, that changes to it are controlled, and that a human exercised oversight and left evidence of it. Each of those five becomes an auditor question, and this article takes them in the order a SOX program would address them. Treat the five questions as a practical synthesis of current auditor concerns. No official PCAOB or SEC checklist with five questions exists, and I would be wary of anyone who presents one. The article is written for controllers, SOX control owners, and internal auditors who need working answers before fieldwork starts.

You do not need a separate AI compliance program to get there. COSO released guidance on internal control over generative AI in February 2026 that applies its Internal Control Integrated Framework to generative AI, and it names the risks that matter most to financial reporting: prompt-based manipulation, opaque reasoning, model drift, and frequent configuration changes. SEC staff remarks at the December 2025 AICPA and CIMA conference, as summarized in an EY compendium, pointed the same way, with attention on model design, data, human oversight, and the way AI changes IT general controls. What follows turns that direction into an inventory, a control narrative standard, a validation plan, a change register, and a failure path you can build this quarter.

 

AI Governance Frameworks For Risk Managers

 

Corporate environments are adopting autonomous systems at a pace that outstrips traditional oversight mechanisms. Engineering teams ship automated workflows daily. Business units integrate external models into core operations without formal review. The resulting environment creates massive blind spots for risk professionals. You cannot manage what you cannot see, and you certainly cannot audit what you do not understand. The era of treating artificial intelligence as a mere productivity enhancement is over. It is now a foundational component of enterprise architecture. This shift demands a complete rethinking of control environments.

Risk managers, compliance officers, and cybersecurity experts must transition from passive observers to active architects of machine behavior. The theoretical debates about future capabilities no longer matter. The immediate reality involves managing current deployments that process sensitive data, execute financial transactions, and interact directly with customers. Professionals who master this transition will define the next decade of corporate governance. Those who fail will preside over catastrophic compliance failures and severe reputational damage.

This guide provides a direct, actionable blueprint for securing autonomous systems. We will explore five essential pillars of modern risk management. These pillars move beyond basic policy documents. They focus on the practical implementation of controls, the integration of global standards, and the strategic career positioning of governance leaders. You will learn how to validate machine outputs, secure third-party integrations, assign legal accountability, capture institutional context, and manage the hidden costs of automated code generation.

The Risk Management Blueprint: A Practitioner's Guide to Quantitative GRC

 

Risk management has a credibility problem. Not because the profession lacks talent, but because color-coded heat maps, ordinal scoring matrices, and quarterly dashboard reviews were never built to change decisions. They exist to document that a compliance process took place. Executive teams know this. They react accordingly by treating risk departments as corporate overhead instead of strategic assets.

I wrote this book to help my peers turn that dynamic around.

After 25 years leading risk functions and advising executive boards across complex multinational companies, I needed a manual that actually bridges advanced quantitative methods with the daily decisions that determine business outcomes. That drive is why The Risk Management Blueprint hit #9 among the most sold risk management books in the weeks after publishing.

At 867 pages, it gives practitioners a single unified methodology across every major risk domain, covering AI systems, cyber exposure, financial cash flows, sustainability transitions, and human behavior. The framework rests on probability theory, financial modeling, and decision science so you can swap subjective scores for numbers that stand up in the boardroom.

You can preview the first four chapters and access the book here: https://amzn.to/4ciag1F

This is not a textbook. It does not spend the majority of its pages diagnosing what is broken in the profession before gesturing toward improvement in a final chapter. More than 70 percent of the book's total length is allocated to domain applications and advanced analytical infrastructure, meaning the bulk of every page is spent on how to build, calibrate, and apply quantitative and predictive risk models across the decisions that actually shape organizational outcomes.

SOC 2 Is Not Security: A Critical Guide for GRC Managers

Let us be direct. SOC 2 is not a security certification. It is an attestation report issued under AICPA standards in which a licensed public accounting firm expresses an opinion on whether a service organization controls met the selected trust services criteria. The report does not declare that your product is safe. It does not certify that your penetration test was rigorous. It does not prove that your attack surface is small or that your customers are protected from a breach. It states that management described a system, selected criteria, asserted controls, and the auditor found those controls suitably designed and, for a Type II report, operating effectively during the specified period.

That distinction matters more than many teams are willing to admit. The report can create a polished artifact that procurement teams accept, but the underlying controls may still be thin, poorly scoped, or disconnected from the technical reality of the product. The phrase SOC 2 is the audit version of trust me bro became popular for a reason. When the PDF is stronger than the security program, the market starts rewarding documentation rather than operational resilience. As a GRC leader, your job is to reverse that sequence. Build the controls, operate them, collect evidence continuously, and let the SOC 2 report fall out as a byproduct rather than serving as the starting point.

This guide walks through the exact gaps that make SOC 2 incomplete as a security signal, how to read a report without wasting your review cycle, how to build a security-first program that makes SOC 2 the output, how to use continuous assurance strategically, and how to govern vendors that hand you a SOC 2 report and expect instant approval. The focus is practical because the risk owner in the room rarely needs another abstract debate. You need a method for using SOC 2 as one piece of evidence among many.

The article is intended for a global audience. SOC 2 is a US-origin AICPA attestation product, but it is now exchanged across borders by cloud providers, software vendors, data processors, and AI product teams. It often sits alongside ISO/IEC 27001, NIST Cybersecurity Framework, CIS Controls, GDPR, HIPAA, NIS2, and emerging AI governance obligations. That means the underlying discipline remains the same. Understand the limitations, own the controls, and never outsource your risk judgment to a report.

 

The Quantitative Revolution In Enterprise Risk Management

Traditional risk management has reached an inflection point where intuition and qualitative heat maps no longer suffice for navigating complex, interconnected business environments. The modern governance, risk, and compliance director faces a paradox: organizations generate more data than ever before, yet decision makers remain plagued by uncertainty about the very risks that could derail strategic objectives. This gap between information availability and decision quality stems from reliance on uncalibrated expert judgment, measurement of irrelevant variables, and risk models that violate fundamental mathematical principles. The solution lies not in abandoning human expertise, but in rigorously calibrating it through quantitative methods that transform subjective opinions into defensible, mathematically sound probability assessments.

Organizations that master these quantitative techniques gain a decisive competitive advantage. They allocate capital more efficiently by focusing measurement budgets on variables that actually influence decisions. They avoid catastrophic failures by identifying cascade risks and common-mode vulnerabilities before they materialize. They build organizational resilience through models that reflect physical reality rather than statistical convenience. This transformation requires risk professionals to develop new competencies in probability theory, information economics, and computational modeling. The following techniques represent the distilled wisdom of decades of research in decision science, behavioral economics, and quantitative risk analysis. Each method addresses a specific failure mode in traditional risk management, providing practical tools that GRC directors can implement immediately to elevate their organization's risk maturity from descriptive to predictive to prescriptive.

Machine Learning Predictive Risk Modeling for GRC Professionals

AI Use Cases for Risk Management

Machine learning fundamentally transforms risk management from a reactive, sample based discipline into a proactive, population wide surveillance system. The traditional operational model, where risk professionals manually review periodic samples, apply static heuristic rules, and generate retrospective reports, cannot scale to match the velocity, volume, and complexity of modern business transactions. Machine learning enabled systems continuously monitor entire populations of transactions, access requests, supplier relationships, and control events. These systems identify subtle patterns and emerging risks that consistently escape rigid rule based systems. This paradigm shift does not eliminate the need for human expertise. Rather, it repositions risk professionals from data processors to strategic decision makers who focus their judgment on exceptional cases, ambiguous signals, and high consequence approvals. Organizations that successfully implement this model achieve what was previously impossible. They gain comprehensive risk visibility without proportional increases in headcount, enabling the risk function to scale with business growth rather than becoming an operational bottleneck.

The integration of machine learning into governance, risk, and compliance frameworks aligns directly with the core principles of ISO 31000, which emphasizes that risk management must be dynamic, iterative, and responsive to change. Static controls are inherently blind to novel threats and evolving business environments. By embedding predictive analytics into the risk management lifecycle, organizations transition from merely documenting historical failures to actively preventing future exposures. This requires a fundamental rethinking of the risk operating model. The strongest operating model does not seek to replace the risk professional. Instead, it automates the predictable, prioritizes the unusual, and reserves human judgment for material, ambiguous, or consequential decisions. This symbiotic relationship between human expertise and machine scale forms the foundation of modern, resilient risk management.

  

Hiring a Chief Risk Officer: The Interview Questions That Reveal Judgment (With Good and Bad Answers)

Chief Risk Officer hires fail quietly. Not on day one. Not even in the first six months. They fail around month fourteen, when the board and the executive team realise the person they hired can build a risk report but cannot challenge a portfolio manager who is technically within limits but building a position that could unravel the firm.

That is a very expensive lesson.

This guide covers the full hiring process, from mandate definition through structured interviewing to onboarding. It includes specific questions, what good answers look like, and what weak answers reveal. The goal is to help you hire a CRO who makes the firm better at taking risk intelligently, not just one who documents it carefully.

 

AI Isn't Coming for GRC Jobs. It's Coming For The Manual Review Part of Every GRC Job

Here's the uncomfortable part nobody says out loud in a GRC conference room. AI is not replacing risk managers, compliance officers, auditors, cyber teams, controllers, or sustainability experts. It's replacing the manual review work that used to justify half of those job descriptions. What's left after that work disappears is judgment, and judgment is either your biggest career asset right now or the skill you never actually built because the manual work always came first.

Every one of these six professions is being pulled through the same transformation at the same time, just wearing different clothes. Risk teams are using AI to process larger volumes of exposure data faster than any analyst could by hand. Audit is automating the routine testing that used to eat most of fieldwork season. Cyber teams are automating alert triage and first-line response. Compliance is watching AI surface policy conflicts across thousands of documents in the time it used to take to review one contract. Controllers are automating reconciliations and close procedures. Sustainability teams are automating ESG data extraction and disclosure drafting.

None of that is a headcount story on its own. It becomes one for the people who don't adapt, because the professionals who can validate AI outputs, challenge exceptions, and decide where a human still has to sign off are becoming the only ones a board actually needs in the room.

 

S/4HANA Role Redesign: Fix Segregation of Duties Before Go-Live or Pay the Audit Bill After

 

Why Privilege Creep Kills SAP Migrations Before the First Production Transaction Runs

Your migration to SAP S/4HANA is six months out. The project team is focused on data migration, Fiori tile configuration, and cutover planning. Meanwhile, 847 user roles built across eight years of organizational changes, job transfers, emergency firefighter access, and M&A integrations are being lifted wholesale into the new system. Nobody has reviewed them. Nobody has mapped them against the new S/4HANA authorization model. And your external auditors are already asking for the SoD conflict report.

This is the standard failure mode. And it is expensive to fix after go-live.

Migrating unremediated ECC roles into S/4HANA production does not just inherit old access risk. It amplifies it. S/4HANA's simplified data model, new Fiori authorization objects, and transaction replacements create net-new SoD conflicts from role content that was previously clean.

This article gives you the technical remediation workflow to stop that from happening. It covers the SAP-native tools, the sequencing logic, the role design architecture that prevents re-accumulation, and the automated tooling that makes the process viable at enterprise scale.

 

SR 26-2 Is Here: The 2026 Model Risk Guidance That Finally Gives Validators Teeth

On April 17, 2026, the Federal Reserve, the FDIC, and the OCC (collectively, "the agencies") issued SR Letter 26-2, which replaces prior model risk management guidance, the SR 11-7 issued in 2011. This update refines supervisory expectations regarding how banking organizations should calibrate their model risk management frameworks. The guidance is most directly applicable to institutions with total assets exceeding $30 billion, though smaller institutions with complex modeling activities are advised to consider its principles.

The guidance formally excludes simple arithmetic calculations, deterministic rule-based processes, and notably, generative artificial intelligence and agentic artificial intelligence models from the definition of a model. However, the agencies explicitly state that traditional statistical, quantitative, and non-generative artificial intelligence models remain within scope. The primary audience is organizations with over $30 billion in assets, reflecting a tailored supervisory approach that recognizes the lower inherent risk profiles of most community banking institutions.

 

How to Stop Producing Risk Registers Nobody Uses

Enterprise Risk Management programs fail in the same quiet way. They produce polished registers, colorful heat maps, and quarterly reports that look impressive in board packs. Then the organization makes its next major capital allocation, acquisition, or vendor choice using a single-page summary with one projected number and zero reference to the risk framework that consumed thousands of hours to build.

I've watched this pattern destroy the credibility of risk functions across industries. The risk team works hard. Stakeholders get interviewed. Likelihood and impact get scored. And none of it touches the actual decisions that determine whether the organization wins or loses. The gap between risk reporting quality and decision quality is where ERM programs go to die.

This article addresses that gap directly. It provides a stage-by-stage implementation approach for building an ERM program that changes how your organization decides, plans, and allocates resources. Every recommendation comes from field-tested practice, not theory. If your ERM program currently produces documents that live in SharePoint between annual reviews, this post shows you how to fix that.

 

Skills for Compliance Officers, Risk Managers, and Auditors

7 Career Capabilities That Will Separate Compliance Officers Who Thrive in 2026 From Those Who Get Replaced by Algorithms

ING just announced 1,250 job cuts in its compliance operations. ABN Amro plans to replace 35% of its AML division with AI. The Dutch audit office published a report questioning whether the €1.4 billion the banking sector spends annually on anti-money laundering checks actually produces effective outcomes.

Read that last sentence again. The government auditor is asking whether the entire manual compliance model works.

This is not a future scenario. This is happening now, across multiple banks, in one of Europe's most regulated markets. And it raises a question that every compliance officer, risk manager, and internal auditor should be asking themselves today: if my primary value comes from executing manual processes that AI can do faster and more consistently, what exactly is my professional future?

The answer depends entirely on skills. Not certifications. Not years of experience. Skills.

I have spent the last fifteen years working with compliance functions across financial services, industrials, and technology companies. The pattern I see repeating is consistent: the professionals who can quantify risk, challenge AI outputs, and translate regulatory complexity into financial terms the business can act on are becoming more valuable every quarter. The ones who built careers around checklist execution, manual alert processing, and qualitative risk scoring are watching their roles disappear. Sometimes gradually. Sometimes overnight.

This post identifies the seven skills that will define professional survival and advancement in compliance, risk, and audit roles through 2026 and beyond. Each one is grounded in what I see organizations actually hiring for, paying premiums for, and struggling to find.

 

How to Use Large Language Models Securely in Risk Management, Compliance, Cybersecurity, and Audit

 

A compliance officer asked an LLM to analyze a vendor contract for GDPR obligations. The prompt included the full contract text. The contract contained employee names, personal email addresses, salary data from an embedded compensation schedule, and a confidential arbitration clause. All of it went into a third-party API. The compliance officer received a helpful analysis. The organization received a data privacy incident.

Nobody planned for this. The compliance officer was doing good work. The tool produced a useful output. And the organization now had regulated personal data sitting in an external system with no data processing agreement, no retention controls, and no way to request deletion.

That is the paradox of LLMs in GRC. The same capability that makes them powerful for regulatory analysis, risk assessment, and audit automation makes them dangerous when deployed without guardrails. An LLM will process whatever you feed it. It does not distinguish between public regulatory text and confidential personal data. It does not know that the regulation it cited does not exist. It does not understand that the risk score it generated was influenced by training data biases that systematically underweight emerging market vendors.

 

AI for GRC: 10 Use Cases Every Risk and Compliance Team Can Deploy in 90 Days

A compliance analyst at a mid-tier financial institution spent 14 hours last week reading regulatory updates. She flagged three items as potentially relevant to her business. She missed two others that directly affected the firm's cloud outsourcing arrangements. One of those triggered an enforcement action against a peer institution six weeks later.

That story repeats across thousands of GRC teams every week. The volume of regulatory change, vendor risk signals, control evidence, and incident data has exceeded human processing capacity. Not because the people lack skill. Because the volume is physically impossible to cover manually with the rigor the work demands.

AI changes this equation. Not by replacing human judgment, but by compressing the time between a risk signal appearing and a qualified human evaluating it. The 10 use cases in this post are not theoretical. GRC leaders at financial institutions, technology companies, and manufacturing firms are running three to five of these today, cutting manual hours by 30-60% while improving coverage across the full risk population.

Each use case includes the practical workflow, the authoritative framework it maps to, and the implementation path you can follow starting this week.

 

How to Build a Control-Conscious SAP S/4HANA Implementation

Every T-Code, Table, and Design Technique You Need Before Go-Live

The most expensive SAP S/4HANA audit findings are the ones discovered after go-live. Every one of them.

I have watched organizations spend $200,000 remediating a segregation of duties problem that would have cost $5,000 to configure correctly during the explore phase. I have seen a chart of accounts redesign triggered by a post-implementation audit finding that required a partial reimplementation. And I have seen implementations where the system integrator delivered exactly what was specified, but the specifications never included internal controls, so the organization went live with a perfectly built system that had no preventive controls over vendor payments.

These situations are avoidable. Every single one.

This post walks through the complete methodology for building controls into your SAP S/4HANA implementation from day one. It covers the control-conscious implementation team structure, the control design framework with specific T-codes and table references, the audit involvement model, and the SDLC controls that protect the implementation itself. If your implementation is already underway, skip to the section covering your current phase. If you are planning your next implementation, read everything.

 

AI Governance Essentials

Why AI Deployment Now Requires Governance, Not Just Engineering

Artificial intelligence deployment has moved well beyond a technical exercise. What was once framed primarily as model development, application hosting, and iterative improvement now sits squarely within the remit of governance, risk management, compliance, and internal audit. That shift reflects regulatory change, market expectations, and a more mature understanding of how AI systems create both value and exposure across the enterprise.

The original draft focused heavily on product iteration, deployment mechanics, and general technology trends. Those topics matter, but in a professional GRC context they are incomplete unless anchored in accountability, risk ownership, control design, performance monitoring, and assurance. AI systems are not governed effectively merely because they are deployed through modern engineering practices such as CI/CD or MLOps. They require a structured governance model that aligns with recognized frameworks such as ISO/IEC 42001, NIST AI RMF 1.0, COSO Enterprise Risk Management, the IIA Global Internal Audit Standards, and applicable legal obligations including the EU AI Act, privacy laws, sector regulations, and financial reporting requirements where AI affects significant processes.

A practical governance perspective begins with one foundational point. AI is not a single risk category. It is a capability that can introduce, amplify, or obscure multiple risk types at once, including operational risk, model risk, legal risk, compliance risk, information security risk, privacy risk, conduct risk, third-party risk, and reputational risk. In many organizations, this is where governance breaks down. The enterprise treats AI as an innovation program when it should also be treated as a governed business capability subject to the same rigor applied to other material systems and processes.

This distinction matters because controls that are adequate for conventional software may be insufficient for AI-enabled systems. A deterministic business rule can usually be traced to fixed logic. A machine learning model may change behavior as a result of retraining, data drift, feature changes, prompt changes, or vendor model updates. A generative AI application may also produce variable outputs for the same input. For GRC professionals, that means control design must account for non-determinism, data dependency, explainability constraints, and lifecycle volatility.

Effective AI governance therefore starts with a simple but often neglected question. What decision, action, or business process is the AI system influencing, and what is the consequence if it fails or behaves unexpectedly? This framing is more useful than beginning with the underlying algorithm. It allows leaders to assess impact on customers, employees, financial reporting, safety, privacy, regulatory obligations, and organizational objectives.

 

Prof. Hernan Huwyler, MBA, CPA, CAIO: AI Governance, Risk & Compliance Executive | Speaker, Trainer & Advisor

 

I am an AI Risk Manager and Governance, Risk, and Compliance (GRC) executive dedicated to empowering business leaders to achieve strategic objectives through robust AI governance, digital compliance, and responsible AI frameworks. With over two decades of global executive experience spanning four continents, I specialize in guiding Fortune 500 organizations toward financial success and operational excellence by transforming regulatory pressure into a competitive advantage -1.

Tips and example on assurance mapping

Post by Prof. Hernan Huwyler, MBA, CPA, CAIO
AI GRC Director | AI Risk Manager | Quantitative Risk Lead
Speaker, Corporate Trainer and Executive Advisor

Top 10 Responsible AI and Risk Management by Thinkers360

Risk is a pervasive force across all business activities. Every strategic and operational decision depends on producing reliable information about the probability and impact of different outcomes. Assurance services exist to enhance the quality and credibility of this information, enabling leadership to make well-founded decisions with confidence.

The AICPA Special Committee on Assurance Services, commonly known as the Elliott Committee, articulated this principle in its 1997 report, establishing that assurance improves the reliability of information for decision makers. Since then, the scope of assurance has expanded well beyond statutory financial reporting to encompass ESG disclosures, cybersecurity attestations, data privacy compliance, and emerging areas such as AI governance.

The Institute of Internal Auditors defines assurance as the objective examination of evidence for the purpose of providing an independent assessment of governance, risk management, and control processes. This assessment adds credibility to both financial and non-financial information, from audited financial statements to environmental and social reports. In practical terms, assurance delivers the confidence that what needs to be controlled is actually being controlled.

Boards bear ultimate responsibility for ensuring that robust internal control arrangements exist across the entire organization, making assurance a first-order governance obligation rather than a purely operational concern.

Most corporate governance frameworks reinforce this expectation. The UK Corporate Governance Code, NYSE listing requirements, King IV in South Africa, and the EU Corporate Sustainability Reporting Directive all require the board to attest to the effectiveness of internal control and risk management systems. In the United States, SOX Section 404 specifically mandates that management assess and report on the effectiveness of internal controls over financial reporting.

Without a structured approach to coordinating assurance across these requirements, boards risk blind spots, redundant coverage, and misallocated resources. These are precisely the conditions that erode stakeholder trust and invite regulatory scrutiny.

What Is an Assurance Map and Why It Matters

An assurance map is a visual coordination tool that links assurance activities from all providers to the risks threatening organizational objectives. Structured as a matrix, it plots key risks or sequential process steps along the vertical axis against assurance activities along the horizontal axis.

The assurance activities are typically organized according to the IIA Three Lines Model, which was updated in 2020 to replace the former Three Lines of Defense terminology. Under this model, the first line consists of operational management, which owns and manages risk and controls. The second line encompasses risk management, compliance, and other oversight functions that provide expertise, monitoring, and challenge. The third line is internal audit, which delivers independent and objective assurance. Some organizations extend the framework to incorporate external audit and regulatory or board-level oversight as additional assurance layers, though these extensions fall outside the IIA formal model.

The strategic value of an assurance map lies in four dimensions. First, it provides board-level visibility through a consolidated, single-page view of risk coverage across the enterprise. Second, it promotes consistency by establishing a common methodology and language for management, oversight, and reporting. Third, it fosters cross-functional collaboration by making interdependencies between departments visible and actionable. Fourth, it drives cost efficiency by revealing redundancies and enabling reallocation of assurance resources toward areas of genuine exposure.

Keys to Making Decisions on Assurance

Assurance mapping is only as valuable as the decisions it informs. The following principles are critical to leveraging these maps effectively.

Identify Gaps and Eliminate Redundancies

The primary objective of assurance mapping is to detect areas where assurance is absent or unnecessarily duplicated across departments. A well-constructed map reveals the true level of oversight for each risk area, enabling leadership to reduce low-value and redundant efforts while strengthening coverage where it is most needed.

Standardize the Risk Methodology

For assurance mapping to deliver a coherent enterprise-wide view, the underlying risk methodology must be standardized. This includes the risk taxonomy, exposure modeling, and risk appetite thresholds. A common risk language is what enables meaningful coordination and interaction between business owners and assurance providers across all three lines. Without standardization, the map becomes a patchwork of incompatible assessments rather than a reliable decision-making tool.

Align Assurance Effort to Risk Exposure

Link the risk exposure of each process to its current assurance coverage to determine whether assurance costs are proportionate to the organization's risk tolerance. This is the practical application of the concept of reasonable assurance. When excessive assurance concentrates on a single process, leadership should investigate the root causes, such as historical incidents, regulatory mandates, or organizational inertia, before redistributing controls and responsibilities.

Update Governance Documents

When assurance programs are combined or activities reassigned, the governing documents must reflect these changes. This includes organizational policies, the internal audit charter, and departmental mandates. The assurance map is a coordination and visualization tool. It is not a policy instrument in itself and should not be treated as one.

Maintain Information Flow Across All Lines

Consolidating or reassigning assurance responsibilities does not eliminate the need for information sharing. Even when a department no longer directly assures a process, it should continue to receive relevant reporting about the reliability of related controls and the quality of associated outputs. Effective remediation depends on transparent communication of issues and action plans across all functions involved.

Leverage Technology for Continuous Assurance

Modern GRC platforms and data analytics capabilities enable real-time monitoring and continuous assurance, moving organizations beyond periodic point-in-time assessments. Integrating automated controls, exception-based reporting, and interactive dashboards into the assurance map strengthens both coverage and responsiveness. Organizations that embed technology into their assurance architecture gain a significant advantage in the speed and reliability of their risk oversight.

An Assurance Map in Practice

To illustrate the concept, consider a simplified financial month-end closing process at a company operating on SAP. The process-based map below plots process steps and their associated risks along the vertical axis against assurance providers organized by the Three Lines Model along the horizontal axis. It consolidates controls from each line to assess the extent and adequacy of coverage, designed for alignment with SOX Section 404 requirements and the COSO Internal Control Integrated Framework.

  

Each cell in the map reflects the quality and depth of evidence provided by the relevant assurance function, assessed according to three levels.

H stands for High Assurance. Assurance is detailed and performed on a recurring cycle. The depth of audit evidence reduces residual risk to an acceptable level, for example by maintaining low material misstatement risk in accounting processes. Controls are in place and adequately mitigate identified risks. Policies are documented and communicated throughout the organization. IT and business intelligence tools automate controls and flag exceptions for follow-up. Performance metrics are actively monitored by management.

M stands for Medium Assurance. Assurance is not performed on a regular cycle. Controls are not in place to cover all relevant risks. Policies are incomplete or not fully communicated to the responsible parties. Manual controls that could be automated remain in their current state, increasing the likelihood of human error.

L stands for Low Assurance. Little or no assurance is provided over the process. Significant concerns exist regarding the adequacy of controls relative to the risk profile. Few governing policies are documented or enforced.

The governance case for assurance mapping

In the United States, boards oversee risk management and internal control, while management is responsible for establishing, maintaining, and assessing those controls. This governance distinction is important. It would be inaccurate to say that boards directly operate or certify every control across the enterprise. Their role is to oversee whether the organization has an effective system of internal control and risk management, and whether that system is supported by credible reporting and challenge.

That oversight burden has grown significantly. Public companies face Sarbanes Oxley requirements for internal control over financial reporting. Regulated sectors face heightened scrutiny over operational resilience, model risk, privacy, third party dependencies, and cyber controls. Sustainability reporting is also increasing expectations around governance, controls, and attestable data. As complexity rises, boards and executive committees need a clearer and more integrated view of assurance coverage.

Recognized frameworks support this approach. The Institute of Internal Auditors Three Lines Model clarifies the roles of management, oversight functions, and internal audit. The COSO Internal Control Integrated Framework remains the leading basis for evaluating the design and effectiveness of internal control. COSO Enterprise Risk Management links risk oversight to strategy and performance. ISO 31000 provides a widely accepted foundation for risk management principles and governance. Together, these frameworks reinforce the same point. Assurance should be coordinated, risk based, and tied to decision making.

How Assurance Mapping Creates Management Value

The strongest reason to implement assurance mapping is not administrative efficiency. It is better risk oversight.

A well designed assurance map helps leadership answer questions that are often difficult to resolve through fragmented reporting. Which enterprise risks receive strong and recurring challenge. Which critical processes depend too heavily on self assessment or management judgment. Where are multiple teams reviewing the same controls with similar methods. Which material risks are supported by evidence based assurance and which rely on assumptions. Where does remediation stall because findings remain within one function instead of moving through a common governance process.

These insights matter because organizations rarely fail due to a total absence of controls. More often, they fail because risk ownership is unclear, challenge is inconsistent, and fragmented assurance gives leadership a false sense of confidence.

What a Strong Assurance Map Should Include

A useful assurance map begins with the business objectives, risk universe, and critical processes that matter most to the enterprise. The goal is not to map everything. The goal is to make visible the quality and sufficiency of assurance where failure would materially affect performance, compliance, resilience, or reporting integrity.

The structure usually starts with a defined scope such as financial reporting, cybersecurity, third party risk, privacy, revenue, procurement, product quality, or end to end operational processes. For each area, the map should identify the principal risks, the key controls or oversight mechanisms, the functions providing assurance, the nature of that assurance, the frequency of review, the degree of independence, the quality of evidence, and the current assessment of coverage.

This does not require an overly complex model. In fact, one of the most common mistakes is overengineering the framework to the point that it becomes difficult to maintain. The best assurance maps are disciplined, comparable, and practical enough to support real decisions.

 

From Assurance Mapping to Strategic Confidence

Assurance mapping is not an end in itself. It is a means of translating fragmented risk oversight into boardroom confidence and organizational resilience. When executed with disciplined methodology, standardized risk language, and genuine cross-functional commitment, it becomes one of the most powerful tools available to the GRC leader.

The goal is never to eliminate risk entirely. The goal is to ensure that the organization's assurance architecture is proportionate to its risk profile, coordinated across all lines, and transparent to the stakeholders who depend on it. In an era of expanding regulatory expectations, proliferating risk domains, and heightened scrutiny from investors and regulators alike, the organizations that master assurance coordination will be the ones that earn and sustain trust.

Get the latest in corporate governance, risk, and compliance on Twitter

6 Tips for compliance risk mapping

Post by Prof. Hernan Huwyler, MBA, CPA, CAIO
AI GRC Director | AI Risk Manager | Quantitative Risk Lead
Speaker, Corporate Trainer and Executive Advisor

Top 10 Responsible AI and Risk Management by Thinkers360

Corporate Criminal Liability And The Regulatory Case For Compliance Risk Assessments 

The Spanish Criminal Code, as reformed by Organic Law 1/2015, establishes specific requirements for corporate compliance programs that regulate the criminal liability of legal entities. Article 31 bis sets out the conditions under which an organization may be exempted from or receive a reduction in criminal liability, provided it demonstrates that an effective compliance program was in place before the offense occurred. Among the program requirements enumerated in Article 31 bis paragraph 5, the organization must identify the activities within whose scope criminal offenses that must be prevented are likely to be committed. This requirement is, in substance, a mandate for criminal compliance risk mapping.

The Spanish framework shares a common logic with the U.S. Federal Sentencing Guidelines for Organizations under Chapter 8 of the USSG, which recognize an effective compliance and ethics program as a mitigating factor at sentencing. Similarly, the DOJ Evaluation of Corporate Compliance Programs guidance evaluates whether the organization has conducted a bona fide risk assessment that informs the design and resourcing of its compliance program. In both jurisdictions, the core principle is the same: demonstrated and adequate oversight efforts to prevent compliance breaches can materially reduce penalties and, in the Spanish case, provide a complete defense.

The Circular 1/2016 of the Spanish Attorney General's Office provides additional interpretive guidance on the elements of an effective compliance program under Article 31 bis, reinforcing that a meaningful risk assessment is foundational rather than optional. Organizations operating in Spain should also consider alignment with UNE 19601, the Spanish national standard for criminal compliance management systems, which provides a structured framework for implementing these requirements.

The Strategic Purpose Of A Compliance Risk Map or Risk Assessment

Building a compliance program that achieves high business values requires the chief compliance officer to address criminal, regulatory, and ethical risks in a coordinated and systematic manner. A compliance risk map is the instrument that makes this possible. It assesses business activities that may result in criminal offenses or, more broadly, in regulatory, legal, contractual, or ethical breaches.

The risk map serves two fundamental purposes. First, it guides prevention actions such as targeted training programs, the development of policies and procedures, and the design of internal controls proportionate to identified risks. Second, it informs contingency and response actions such as incident management, internal investigations, regulatory notifications, and remediation planning. Without a well-constructed risk map, the compliance program lacks a defensible basis for how it allocates its resources and prioritizes its activities.

Defining The Risk Mapping Scope

The foundation of any credible compliance risk map is a comprehensive risk universe. This universe should encompass all criminal offenses applicable to the organization under the relevant jurisdiction, including those enumerated under Article 31 bis of the Spanish Criminal Code, together with applicable regulations, contractual obligations, voluntary commitments such as industry codes of conduct, and known fraud schemes relevant to the organization's sector.

This risk universe allows the compliance function to classify risk factors in a way that facilitates both mitigation planning and communication to leadership. The compliance risk landscape should address industry-specific regulations, counterparty-related requirements such as anti-money laundering and sanctions obligations, and general regulatory frameworks including data protection, competition law, environmental standards, and occupational health and safety.

For multinational organizations, the risk universe must account for the jurisdictional complexity inherent in operating across multiple legal systems. A practical approach is to group compliance risk domains by general topic, such as bribery and corruption, fraud, data privacy, trade controls, or environmental compliance, and then map each topic to the specific local requirements applicable in each jurisdiction. This structure enables both enterprise-level aggregation and local operational relevance. The compliance requirement inventory should be validated by subject matter specialists from the compliance, legal, and where appropriate, regulatory affairs departments.

Integrating The Compliance Risk Map Into Enterprise Risk Management

A compliance risk map should not exist in isolation. It should be built upon and integrated into the organization's existing enterprise risk management framework. While ERM practices and internal audit risk assessments are not specifically designed to identify legal and regulatory compliance risks, they can be combined, calibrated, or linked to a compliance-specific risk map. The objective is to ensure that compliance risks are visible within the broader risk governance structure rather than siloed in a parallel process.

Following a global ERM policy ensures that the compliance risk map can be readily integrated into the organization's GRC management and reporting architecture. It also ensures that the risk taxonomy, rating scales, likelihood and impact definitions, and risk appetite thresholds are consistent across functions, enabling meaningful comparison and aggregation.

Assessing the financial impact of compliance risks is particularly important. A risk map that relies exclusively on qualitative categories without quantifying potential exposure, including regulatory fines, litigation costs, remediation expenses, and reputational harm, will struggle to compete for leadership attention and resource allocation against commercially quantified risks.

The methodological framework should be supported by recognized international standards. ISO 31000 provides the overarching principles and guidelines for risk management. ISO 37001 establishes requirements for anti-bribery management systems. ISO 37301, which replaced the former ISO 19600 in 2021, sets out requirements for compliance management systems. Alignment with these standards strengthens both the credibility and the defensibility of the risk assessment methodology.

Planning The Risk Assessment From The Top Down

Developing a comprehensive compliance risk map across a large or multinational organization can be time-consuming and resource-intensive. A pragmatic approach is to plan the assessment in phases, beginning at the enterprise level and progressively expanding into greater operational detail.

The chief compliance officer should perform an initial top-down risk assessment to identify the highest-priority risk domains and the organizational units, jurisdictions, and transaction types that warrant the most detailed analysis. This initial assessment should draw on available internal and external data sources to direct effort toward areas of greatest exposure.

The following is a simplified example of how a multinational organization might plan the phased expansion of its compliance risk mapping.

expand

This initial framework can be progressively enriched with additional data from compliance exception reports, detailed whistleblowing and ethics hotline statistics, external audit and tax audit findings, transactional records, regulatory examination results, client complaints, employee surveys, and where relevant, social media and adverse media monitoring data.

Why Qualitative Heat Maps Fail For Legal And Compliance Risk And What To Use Instead

The Structural Failure Of Heat Maps For Compliance Risk Assessment

The five-by-five qualitative heat map, in which likelihood and impact are each rated on a scale from one to five and the product is displayed as a color-coded cell, is the most widely used risk assessment tool in corporate compliance programs. It is also, for legal, regulatory, contractual, and compliance risks specifically, among the most unreliable. The foundational critique articulated by Louis Anthony Cox Jr. in his 2008 paper in Risk Analysis demonstrated that qualitative risk matrices produce ratings that are mathematically inconsistent with the underlying probability and consequence data, that they assign identical ratings to risks with substantially different expected losses, and that they do not support meaningful resource allocation because the coarse categorical ratings cannot be translated into the quantified cost expectations that legal and compliance risk decisions require. These structural deficiencies are problematic for all risk categories, but they are particularly damaging for compliance risks because the consequences of noncompliance are often precisely quantifiable through statutory penalty ranges, contractual liquidated damages, regulatory fine schedules, litigation cost benchmarks, and insurance loss data, meaning that the information needed for rigorous quantification exists but is discarded when the assessment compresses it into a subjective likelihood-impact category. A regulatory fine that could range from fifty thousand to fifty million dollars depending on the severity of the violation, the organization's compliance history, and the jurisdiction's enforcement posture cannot be meaningfully represented as a four on a five-point impact scale. The heat map eliminates exactly the information, the range, the distribution, and the conditional factors, that decision-makers need to evaluate the risk and to determine whether the investment in controls and compliance infrastructure is proportionate to the exposure. When the board reviews a heat map showing that corruption risk is amber and data privacy risk is red, it has received a visual impression but not the decision-quality intelligence needed to determine whether an additional million dollars of compliance investment should be directed toward anti-corruption controls, privacy controls, or an entirely different risk that the heat map's color scheme has rendered invisible.

Data-Driven Quantification Of Compliance Obligation Risk

The alternative to qualitative categorization is the data-driven quantification of compliance risk through models that estimate the cost ranges and probabilities of noncompliance with each of the organization's mandatory and voluntary obligations. ISO 37301:2021, the international standard for compliance management systems that replaced the former ISO 19600, provides the structural framework for this approach. ISO 37301 requires the organization to identify its compliance obligations, both mandatory obligations arising from laws, regulations, and contractual requirements and voluntary obligations arising from industry codes, organizational policies, and stakeholder commitments. It further requires the organization to assess the compliance risks associated with those obligations, including the consequences of noncompliance, and to implement controls proportionate to the assessed risk. The quantitative implementation of this framework involves modeling each obligation's noncompliance consequences as a cost distribution rather than a qualitative rating. For regulatory obligations, the cost distribution can be constructed from the statutory penalty ranges specified in the applicable legislation, the enforcement history of the relevant regulatory authority, the organization's own compliance track record, and the aggravating and mitigating factors that affect penalty determination. For contractual obligations, the cost distribution derives from the liquidated damages provisions, indemnification clauses, termination consequences, and litigation exposure defined in the contract terms. For voluntary obligations, the cost distribution reflects the reputational, commercial, and stakeholder relationship consequences of failing to meet commitments that the organization has publicly undertaken. When these cost distributions are combined with probability estimates derived from the organization's compliance history, its control environment assessment, industry violation rates, and regulatory enforcement trends, the result is a risk-adjusted expected cost of noncompliance for each obligation that can be directly compared to the cost of the controls and compliance infrastructure designed to prevent it. This comparison provides the quantified basis for resource allocation decisions that qualitative heat maps cannot support.

The Corporate Defense Imperative: Why Absence Of Controls Creates Legal Liability

Beyond the resource allocation benefits of quantitative compliance risk assessment, there is a legal and governance imperative for maintaining documented, functioning controls and policies that address identified compliance obligations. When an organization experiences a compliance failure, whether a regulatory violation, a contractual breach, or an incident that causes harm to third parties, the legal inquiry that follows will evaluate not only what happened but whether the organization took reasonable steps to prevent it. In negligence-based claims, the plaintiff or the regulator must establish that the organization owed a duty of care, that it breached that duty, and that the breach caused the harm. The existence and quality of the organization's controls, policies, and compliance program are the primary evidence through which the organization demonstrates that it met its duty of care, or through which the claimant demonstrates that it did not. An organization that cannot produce evidence of documented policies addressing the relevant risk, that cannot demonstrate that controls were designed and implemented to prevent the type of failure that occurred, and that cannot show that those controls were monitored and tested for effectiveness faces a corporate defense gap that significantly increases its liability exposure. The DOJ Evaluation of Corporate Compliance Programs, the UK Bribery Act Section 7 adequate procedures defense, Article 31 bis paragraph 5 of the Spanish Criminal Code as discussed in the earlier post on Spanish corporate criminal liability, and the U.S. Federal Sentencing Guidelines' culpability score reductions all operationalize this principle: the organization's compliance program, including its risk assessment, its controls, its policies, and its monitoring and testing activities, is evaluated as evidence of organizational diligence that can reduce or eliminate liability. An organization that relies on a qualitative heat map to demonstrate that it assessed its compliance risks and determined appropriate controls will find that the heat map provides no defensible connection between the assessed risk level and the controls it implemented, because the qualitative ratings do not correspond to quantified consequences that can justify specific control investments.

Building The Quantitative Compliance Risk Model

The practical construction of a data-driven compliance risk model requires the organization to inventory its compliance obligations following the ISO 37301 framework, to research and document the consequence ranges for noncompliance with each obligation using statutory penalty schedules, enforcement databases, contractual terms, and litigation benchmarks, to estimate the probability of noncompliance based on the organization's control environment quality, its compliance history, industry violation rates, and the regulatory enforcement posture in each relevant jurisdiction, and to combine these estimates through stochastic methods such as Monte Carlo simulation to produce a probability-weighted cost distribution for each obligation and for the aggregate compliance portfolio. This model replaces the subjective assignment of a likelihood score and an impact score with an analytically grounded estimate that can be validated against observable data, challenged by subject matter experts, updated when the regulatory environment changes, and directly compared to the cost of the controls designed to reduce the noncompliance probability. The model also provides the sensitivity analysis that reveals which obligations carry the greatest expected cost of noncompliance, which obligations are most sensitive to changes in control effectiveness, and where incremental compliance investment produces the greatest reduction in expected loss. This analytical capability is what enables the chief compliance officer and the board to make informed, defensible decisions about compliance program scope, resourcing, and prioritization, decisions that a five-by-five heat map with color-coded cells cannot support because it does not contain the information needed to make them.

From Color-Coded Impressions To Defensible Compliance Governance

The transition from qualitative heat maps to quantitative compliance risk assessment is not merely an analytical improvement. It is a governance necessity for organizations that face material legal, regulatory, contractual, and compliance obligations. The heat map creates the appearance of risk assessment without producing the decision-quality intelligence that effective compliance governance requires. It cannot demonstrate to a regulator that the organization's compliance investments are proportionate to its obligations. It cannot demonstrate to a court that the organization exercised reasonable care in designing controls to prevent the harm that occurred. And it cannot demonstrate to the board that the compliance program's resources are allocated to the obligations that carry the greatest expected cost of noncompliance. The quantitative model, grounded in the ISO 37301 obligation inventory, populated with evidence-based cost ranges and probability estimates, and analyzed through stochastic methods that produce risk-adjusted expected costs with defined confidence levels, provides all of these capabilities. It transforms compliance risk assessment from a periodic exercise that produces a visual artifact into a continuous analytical process that produces the defensible, decision-relevant intelligence that regulators evaluate, that courts examine, and that boards need to fulfill their governance obligations. The organizations that make this transition will find that their compliance programs are not only more effective at preventing noncompliance but more defensible when noncompliance occurs, because the analytical foundation of their risk assessment demonstrates the rigor, the proportionality, and the evidence-based reasoning that constitute the corporate defense against claims of negligence, inadequate supervision, and organizational failure.

 

Ensuring Broad Coverage And Operational Proximity

An effective compliance risk map must cover the actions and decisions of all individuals who act on behalf of or in connection with the organization, including board members, directors, managers, executives, employees, consultants, agents, and suppliers. Article 31 bis of the Spanish Criminal Code specifically addresses offenses committed by senior officers and by individuals subject to their authority or supervision, making breadth of coverage a legal requirement as well as a best practice.

The assessment process should involve personnel at multiple organizational levels, across jurisdictions and functional areas, to limit the cognitive and positional biases that inevitably arise when risk assessments are conducted exclusively by headquarters functions. Capturing perspectives from both senior leadership and operational staff ensures that the map reflects both strategic and ground-level risks. Performing assessments close to operations, at the site, business unit, or country level, significantly increases the probability of identifying the most relevant and material risks rather than generic or theoretical ones.

Clear ownership of each compliance risk must be established to facilitate the management of action plans, the tracking of remediation, and the escalation of issues through the governance structure. The chief compliance officer must maintain a comprehensive understanding of the full spectrum of compliance requirements and emerging issues across the organization's operating footprint. External legal advisors and specialized consultants can provide valuable support, particularly for jurisdictional-specific requirements and novel risk areas.

Building Trust To Surface Genuine Risks

The quality of a compliance risk assessment depends directly on the willingness of risk owners and operational managers to disclose their genuine risks and vulnerabilities. This willingness is a function of trust. Risk owners will provide candid and complete information only when they have confidence in the integrity and competence of the individuals conducting the assessment and believe that the process will lead to constructive action rather than punitive consequences.

Involving locally recognized and respected leaders in the risk mapping process is essential. Their participation signals organizational commitment and encourages open engagement from operational teams. Introducing the risk mapping initiative through compliance training sessions also creates a positive working environment and ensures that participants understand the purpose, methodology, and expected outcomes before they are asked to contribute.

Dynamic Follow-Up And The Compliance Culture

A compliance risk map that is produced once and then archived is not a compliance program. It is a document. In Spain, commentators and practitioners refer to this failure as compliance cosmético, the appearance of compliance without operational substance. The English-language equivalent is often described as paper compliance or window-dressing. Under both the Spanish Criminal Code and the DOJ Evaluation of Corporate Compliance Programs guidance, regulators evaluate whether the program is implemented and enforced in practice, not merely whether it exists on paper.

Compliance risks must be followed up dynamically and with a frequency proportionate to their exposure. This ongoing process includes reviewing the results of action plans against defined milestones, producing and monitoring key risk indicators, and escalating emerging or deteriorating risks to the appropriate risk committees, executive leadership, or the board.

The compliance risk landscape is not static. New risks emerge continuously from regulatory changes, enforcement trends, strategic decisions such as market entry or acquisitions, organizational restructuring, technological change, and the evolving sophistication of cybercrime and fraud schemes. A compliance risk map that does not evolve with the organization and its environment will rapidly become obsolete and will fail to provide the defensibility that the legal framework requires.

The dynamic follow-up of compliance risks and action plans is what transforms a risk map from a static inventory into a living instrument of the compliance culture. It is this ongoing discipline, visible to employees at all levels, that demonstrates the organization's genuine commitment to ethical and lawful conduct.

 

References

Spanish Criminal Code, including the framework relevant to legal entity liability and Article 31 bis

US Federal Sentencing Guidelines for Organizations

US Department of Justice. Evaluation Of Corporate Compliance Programs

ISO 31000 Risk Management Guidelines

ISO 31022 Legal Management Guidelines 

ISO 37001 Anti Bribery Management Systems Requirements With Guidance For Use

Committee of Sponsoring Organizations of the Treadway Commission. Enterprise Risk Management Integrating With Strategy And Performance

 

Get the latest in corporate governance, risk, and compliance on  Twitter