Risk Heat Maps to Monte Carlo: Practical Guide for Risk Owners

By Prof. Hernan Huwyler, MBA CPA CAIO · Academic Director, IE Law School
Published 4 November 2026 · Last reviewed 4 November 2026

In short

• A risk heat map is a vage way to display risk, not a measure of financial exposure. It never tells decision-makers how much they could lose, how often, or which assumptions drive the result.
• Range compression and rank reversal can conceal important differences between risks, therefore, it will induce wrong decision-making. Simply multiplying frequency by impact with qualitative scales and scores is professional malpractice.
• Loss exceedance curves provide a more useful alternative. When historical data is limited or unavailable, model uncertainty explicitly instead of relying on arbitrary colour categories.

 

A risk workshop ends at four in the afternoon. Twenty people have argued for two hours about whether a vendor outage is a three or a four on likelihood, and the facilitator closes by moving a dot into a yellow cell. Everyone leaves with the feeling that something was decided. Nothing was. Nobody can say how much money the company might lose, how often, or which assumption would change the answer.

A risk heat map is a display format. It is not a risk analysis, and it cannot replace one. The replacement is a quantified model: frequency and severity estimated as ranges, combined by simulation, and reported as a loss exceedance curve that tells an executive the probability of losing more than a given amount in a year. This guide is for risk owners, fraud and cybersecurity leads, internal auditors, and AI product owners who need to defend a number in front of a board and want a method that survives questions.

The path runs in a fixed order. First you see why the matrix fails, with the research behind it. Then you replace frequency times impact with the correct combination of the two distributions, build the curve, handle missing data, add machine learning where it earns its place, and connect the output to a decision. The last section covers the politics of retiring a tool that management likes.

 

Compliance Theater Is Hiding Your Biggest Security Risks

By Prof. Hernan Huwyler, MBA CPA CAIO · Academic Director, IE Law School
Published 17 October 2026 · Last reviewed 17 October 2026

In short

• Compliance should be the outcome of an effective security programme, not a substitute for one. Reversing that logic can produce certificates and completed checklists while leaving critical security gaps undiscovered.
• Replace activity-based metrics with evidence of results: verified remediation, actual asset and vulnerability scan coverage, and audit evidence generated through routine operations.
• Attackers often exploit assets that the organisation does not know exist. An incomplete asset inventory can therefore undermine even a well-documented compliance programme.

 

Consider an illustrative scenario, a composite of patterns that repeat across security programs. A payments processor presents its quarterly security report to the audit committee. Every scheduled vulnerability scan ran on time. Nearly all employees finished security training, the certification renewed without a gap, and every audit finding from the prior year is closed. Three weeks later an attacker enters through a server that never appeared on a scan target list, because the team built it after the list was last updated. The report was accurate on every line, and it still told the committee nothing about whether the company was getting safer.

Compliance is a byproduct of security. When an organization knows its threats, protects the assets that matter, tests its controls, and fixes weaknesses until a retest confirms the fix, most of its compliance evidence becomes a record of work already done to reduce risk. When the sequence runs the other way, the organization collects evidence first and hopes protection follows. That gap is where false confidence grows, and decision-makers stop asking hard questions at the moment they most need to ask them. This article is for CISOs and compliance officers who want to report outcomes instead of activity, and it ends with seven metrics you can start swapping in this quarter.

The argument covers the obligations most teams already carry. GDPR, NIS2, HIPAA, SOX, PCI DSS, ISO/IEC 27001, and SOC 2 each ask, in different words, whether controls work and whether you can show it. Compliance stays a legal and contractual duty with its own deadlines, and nothing here argues for skipping it. The point concerns order and evidence. Security work comes first, and the records that work produces earn the compliance claim. The sections below cover what each obligation requires, how checkbox reporting goes wrong, which metrics replace it, and how to make the evidence trail a normal output of operations.

 

Guide for Risk Managers for DORA Compliance

By Prof. Hernan Huwyler, MBA CPA CAIO · Academic Director, IE Law School
Published 16 October 2026 · Last reviewed 16 October 2026

In short

• DORA has applied since 17 January 2025. The priority is now demonstrating that data, accountable owners and operational processes can support compliance and respond to supervisory scrutiny.
• Map critical or important functions to the ICT assets and services that support them before preparing reporting templates. This register provides the foundation for the wider DORA program.
• Build the programme around day-to-day operations, with particular attention to incident reporting deadlines and ICT third-party oversight, two areas where implementation can become difficult.

 

A quarterly operational risk report that takes four months to produce is already a DORA problem, and nobody has opened the regulation yet. By the time the report lands, two newer quarters of incidents, supplier changes and control failures have happened. The Digital Operational Resilience Act, Regulation (EU) 2022/2554, has applied since 17 January 2025, so the open question for most financial entities is no longer when to start. The question is whether their data, owners and processes can answer a supervisor within hours instead of months.

The short answer is to build one maintained dependency model that links each critical or important function to its information, ICT assets, providers, contracts, incidents and test results, and then run the five DORA chapters on top of it. The chapters cover ICT risk management, incident management and reporting, resilience testing, ICT third-party risk, and information sharing. Most of the effort sits in the links between those chapters. A firm that treats them as five projects ends up with five registers that disagree with each other.

This guide is for risk owners, compliance officers, internal auditors and security leads who have to turn the regulation into working procedures. It follows the order in which a program usually runs, and it separates what the regulation requires from what is a sensible implementation choice. It also corrects several statements that circulate in conference slides and vendor material, such as the idea that DORA requires threat-led penetration testing from every firm.

 

How to Plan, Govern, and Build Enterprise AI Agents and AI Architecture

By Prof. Hernan Huwyler, MBA, CPA, CAIO · Academic Director, IE Law School
Published 14 October 2026 · Last reviewed 14 October 2026

In short

• An AI pilot can perform impressively in a controlled demonstration yet fail in production when real users, operational costs, data access, permissions and unpredictable outputs enter the picture.
• Enterprise AI governance must extend beyond model selection and prompt design. It must cover the complete operating environment: data, integrations, identity, access rights, monitoring, escalation and accountability.
• AI agents need clearly defined permissions and boundaries. Their ability to call tools, retrieve information or initiate transactions should be limited to approved tasks and risk levels.
• Deterministic software controls should enforce critical business rules, security requirements and approval thresholds. Prompts and model instructions alone are not reliable enforcement mechanisms.
• Successful AI deployment requires named business and technical owners, measurable performance indicators, human intervention procedures and continuous monitoring after go-live.
• The central lesson for executives, AI architects and risk professionals: production readiness is an architecture and governance challenge, not simply a question of choosing a more powerful AI model.

 

AI governance professionals need more than policies. They need to understand how AI systems are designed, where controls belong, and what happens when agents act in the real world.

An AI pilot can look impressive in a demonstration and still fail when a company tries to put it into production. Costs grow, permissions become difficult to manage, outputs vary, and nobody knows exactly who should intervene when something goes wrong.

For risk managers, internal auditors, compliance officers, cybersecurity experts, and IT professionals, these are not abstract technology problems. They are questions of accountability, control design, operational resilience, and business value.

That is why I believe AI architecture deserves a place at the center of enterprise AI governance.

 

Essential Skills for GRC, Finance, Legal and Cyber in 2027 and 2028

This article answers one worry: if AI now drafts the policies, tests the controls, reviews the contracts and triages the alerts, what is left for a GRC, finance, legal or cyber professional to do? The answer is five human skills, ranked by how well they protect your job: professional judgment (called taste in the AI community), agency, follow-through, focus and resourcefulness. Each one sits where automation stops and accountability starts. Judgment decides which AI output is sound and defensible. Agency moves you from the person who samples 40 payments to the person who runs the agent that checks all 18,000. Follow-through makes the work land with the people who rely on it. Focus keeps you on the few exposures that matter, and resourcefulness lets you take on the unfamiliar projects others decline.

The key advice is to build these skills on one real project instead of reading about them. Pick one control you test by sampling today, write the decision it supports and who makes it, and run an agent across the whole population. Write down the rules you used to sort real exceptions from noise, because that is your judgment on paper. Keep humans on irreversible decisions, give every agent an owner, a boundary and a log, and stay with the work until the business actually uses it. Revisit the projects you ruled out, since the constraint that stopped them may be gone. Employers will pay for the professional who can show the exposure chosen, the decision supported and the person who relies on the result.

Consider a composite situation, not a real engagement. An internal auditor at a mid-sized manufacturer spends two weeks every quarter testing a sample of 40 payments out of roughly 18,000 for duplicates and approval breaches. That sample covers about 0.2 percent of the population, and everyone in the room knows it. An AI agent can now read all 18,000 payments overnight and hand the auditor a short list of exceptions by Monday morning. The two weeks of sampling are gone, and so is the part of the job that looked like work.

The question for 2027 and 2028 is what the auditor does with the other thirteen days. The short answer is five human skills, and I rank them here by how well they protect a GRC, finance, legal or cybersecurity career from displacement by automation of repetitive analysis, reporting and control reviews. In order of job-market relevance they are professional judgment, agency, follow-through, focus and resourcefulness. This article is for risk analysts, internal and external auditors, compliance officers, finance controllers, in-house lawyers and security engineers who want to know which habits employers will pay for once everyone has the same AI tools.

AI has removed the old excuses that kept capable professionals from acting on what they already understood: no time, no access, no technical skill. That makes the call to action simple. Revisit the projects you ruled out in the last three years, because the constraint that ruled them out may no longer exist. AI has expanded what is possible in risk management, auditing, compliance, cybersecurity, legal work and finance faster than most people have expanded what they are willing to attempt, and that gap is where your next promotion sits.

Agentic AI in Internal Audit, What to Automate, What to Keep

 

Consider an illustrative scenario, not a real engagement. A mid-sized distributor connects an audit agent to its ERP, its document repository and its ticketing tool. Within a week the agent has pulled invoices, receipts and approvals for 240 purchase orders and produced a tidy memo saying the procure-to-pay control passed. The audit manager reads it, likes it, and asks the only question that matters: which records did the agent open? Nobody can answer.

The short answer to the sequencing problem is this. Agentic AI should first take bounded, repeatable, evidence-based work: a finite set of documents, stable rules, and output you can check against a known result. It must not decide audit scope, judge whether evidence is sufficient, conclude that a control works, rate a finding, or close an issue. Those decisions belong to accountable auditors, and an agent can only prepare the ground for them.

This article is for internal auditors, chief audit executives and the managers and audit committee members who oversee them. After reading it you will be able to sort audit tasks into automate now, automate with review gates, and keep human. You will also have a short list of access rules, evidence requirements and escalation triggers to put in place before any agent touches a workpaper. The question to ask is not whether AI can replace internal auditors. Ask which audit activities are bounded enough to automate safely, and which decisions need independent professional judgment and a named person who answers for them.