Click here to access subscription content at The RTJ Bridge - The Premium Version of The RiskTech Journal
〰️
Click here to access subscription content at The RTJ Bridge - The Premium Version of The RiskTech Journal 〰️
The RiskTech Journal
The RiskTech Journal is your premier source for insights on cutting-edge risk management technologies. We deliver expert analysis, industry trends, and practical solutions to help professionals stay ahead in an ever-changing risk landscape. Join us to explore the innovations shaping the future of risk management.
When Robots Walk, Risk Converges - Humanoids and the Future of Integrated Risk Management
For IRM professionals, the emergence of humanoids provides a rare moment of clarity: no single risk domain can manage this disruption in isolation. Humanoid robotics is where GRC, ERM, ORM, and TRM collide—and where their integration becomes essential.
The AI Wild West is Over — Why IRM Must Now Govern the Frontier
When John A. Wheeler and Avivah Litan collaborated as colleagues at Gartner, they shared a simple but powerful conviction: technology without governance invites risk, and risk without context invites disaster. That belief feels more urgent than ever in the age of generative AI.
This month, Avivah returned to the spotlight with a compelling Gartner webinar titled “A Partner Framework to Manage AI Governance, Trust, Risk and Security.” It laid out a comprehensive vision for AI Trust, Risk, and Security Management (AI TRiSM), exposing the vulnerabilities of current AI adoption strategies and presenting a future where organizations no longer treat AI oversight as optional.
But here’s the problem: most companies are still stuck in a fractured model of Governance, Risk, and Compliance (GRC). And the rise of autonomous, agentic AI systems is about to make that dysfunction terminal.
The Risk Ignored — Part 1: Revisiting the Origin Story of a Software Industry
Some of the biggest failures in modern risk management didn't happen because we lacked frameworks. They happened because we misunderstood risk and how it must be managed.
We've built controls. We've stood up compliance programs. We've adopted acronyms and bought technology platforms promising enterprise-wide oversight. Yet risk still slips through the cracks—not because it isn't documented, but because it isn't truly visible and understood.
I've spent 35 years helping organizations—from Fortune 100 giants to growing mid-market firms—face this reality. And the truth is this: risk management has always been more fragmented, political, and performative than most are willing to admit.
“The Risk Ignored” is a documentary-style series of articles I’ve created to give readers exclusive insights into what really happened in the last 25 years of risk management technology development.
No Manager, No Strategy—Why GRC Alone Can’t Win the Risk Game
If Governance, Risk, and Compliance (GRC) is like a team without a manager, IRM is the system that brings structure, alignment, and leadership to the field. Without a manager, even talented players operate in silos—doing what they think is best individually but without strategic coordination or shared purpose. That’s the reality in many organizations today: siloed compliance, governance, and risk functions acting without integration.
IRM provides the playbook and the leadership. It integrates GRC with Enterprise Risk Management (ERM), Operational Risk Management (ORM), and Technology Risk Management (TRM) to form a unified team—managed strategically, guided by data, and aligned around shared enterprise objectives.
The Limits of Legacy GRC — Seven Reasons It Fails Modern Risk Management
In the corridors of risk management conferences and behind closed doors at technology vendor meetings, there's a reluctant acknowledgment that few are willing to voice publicly — traditional Governance, Risk, and Compliance (GRC) platforms are struggling to meet the demands of today's dynamic risk landscape. As someone who has spent decades consulting with both GRC vendors and their customers, I've heard the whispered confessions from technology providers who recognize these limitations but fear alienating their long-standing clients by admitting them openly.
Moving Beyond the GRC Mindset - Why Boards Must Rethink Risk for the AI Era
I’m often questioned—sometimes challenged and occasionally attacked—by professionals who are deeply invested in traditional Governance, Risk, and Compliance (GRC) approaches. For many, GRC isn’t just a framework or a set of tools—it’s an identity, a career foundation, and in many cases, a commercial interest. So when I suggest that risk management must evolve beyond legacy GRC models, I’m not just raising a strategic argument—I’m challenging a belief system.
But this is not about abandoning GRC. It’s about recognizing that GRC, in its traditional, siloed, compliance-first form, is no longer sufficient for today’s risk environment.
The Myth of Internal Audit Independence: Why It’s Time to Evolve Beyond GRC Thinking
The debate over the true independence of internal audit (IA) has resurfaced with new urgency following the recent high-profile firings of multiple inspectors general (IGs). Government IGs in the United States operate in similar ways to IA in private-sector organizations. Given their similarity, these IG dismissals have sparked controversy within the IA community, with critics arguing they threaten government oversight and accountability. The situation underscores a long-standing issue: IA and IGs are not truly independent, and continuing to believe otherwise does more harm than good.