Click here to access subscription content at The RTJ Bridge - The Premium Version of The RiskTech Journal
〰️
Click here to access subscription content at The RTJ Bridge - The Premium Version of The RiskTech Journal 〰️
The RiskTech Journal
The RiskTech Journal is your premier source for insights on cutting-edge risk management technologies. We deliver expert analysis, industry trends, and practical solutions to help professionals stay ahead in an ever-changing risk landscape. Join us to explore the innovations shaping the future of risk management.
Live from RSA: Autonomous IRM Moves from Vision to Reality
The RSA Conference is renowned for highlighting significant shifts in cybersecurity and risk management. This year, alongside familiar conversations about persistent cybersecurity threats and regulatory pressures, a deeper transformation is occurring: the rise of Autonomous Integrated Risk Management (Autonomous IRM). Vendors at RSA 2025 are showcasing solutions that go beyond merely automating routine tasks, moving toward independently identifying, assessing, and mitigating risks across enterprise ecosystems without constant human intervention.
When Robots Walk, Risk Converges - Humanoids and the Future of Integrated Risk Management
For IRM professionals, the emergence of humanoids provides a rare moment of clarity: no single risk domain can manage this disruption in isolation. Humanoid robotics is where GRC, ERM, ORM, and TRM collide—and where their integration becomes essential.
The Risk Ignored — Part 1: Revisiting the Origin Story of a Software Industry
Some of the biggest failures in modern risk management didn't happen because we lacked frameworks. They happened because we misunderstood risk and how it must be managed.
We've built controls. We've stood up compliance programs. We've adopted acronyms and bought technology platforms promising enterprise-wide oversight. Yet risk still slips through the cracks—not because it isn't documented, but because it isn't truly visible and understood.
I've spent 35 years helping organizations—from Fortune 100 giants to growing mid-market firms—face this reality. And the truth is this: risk management has always been more fragmented, political, and performative than most are willing to admit.
“The Risk Ignored” is a documentary-style series of articles I’ve created to give readers exclusive insights into what really happened in the last 25 years of risk management technology development.
No Manager, No Strategy—Why GRC Alone Can’t Win the Risk Game
If Governance, Risk, and Compliance (GRC) is like a team without a manager, IRM is the system that brings structure, alignment, and leadership to the field. Without a manager, even talented players operate in silos—doing what they think is best individually but without strategic coordination or shared purpose. That’s the reality in many organizations today: siloed compliance, governance, and risk functions acting without integration.
IRM provides the playbook and the leadership. It integrates GRC with Enterprise Risk Management (ERM), Operational Risk Management (ORM), and Technology Risk Management (TRM) to form a unified team—managed strategically, guided by data, and aligned around shared enterprise objectives.
When Encryption Isn't Enough—A Sidewalk Interview and a Global Wake-Up Call
I was in Washington, D.C., when the story broke. Reports surfaced that U.S. officials had used Signal—a consumer-grade encrypted messaging app—to coordinate sensitive military operations in Yemen. I was finishing a dinner meeting after a full day of engagements when my phone rang. It was the BBC reaching out for immediate commentary on a fast-developing national security story.
Why Generative AI Is Breaking Cyber Insurance—and What Risk Leaders Must Do Next
The promise of generative artificial intelligence (AI) is captivating: it automates content creation, accelerates decision-making, and unlocks new efficiencies across industries. But beneath this glittering facade lurks an existential threat that few executives acknowledge: these systems are introducing catastrophic risks that cyber insurance markets are neither prepared for—nor willing to underwrite fully. As insurers frantically scramble to recalibrate policies in light of AI-driven threats, risk executives face a stark choice: transform how they manage emerging digital risks or face potentially devastating uninsured losses.
The Limits of Legacy GRC — Seven Reasons It Fails Modern Risk Management
In the corridors of risk management conferences and behind closed doors at technology vendor meetings, there's a reluctant acknowledgment that few are willing to voice publicly — traditional Governance, Risk, and Compliance (GRC) platforms are struggling to meet the demands of today's dynamic risk landscape. As someone who has spent decades consulting with both GRC vendors and their customers, I've heard the whispered confessions from technology providers who recognize these limitations but fear alienating their long-standing clients by admitting them openly.
The Great Risk Revolution—Why GRC Alone Can't Save Your Organization
In boardrooms across the globe, a quiet revolution is underway. Organizations that once viewed risk management primarily through the lens of Governance, Risk, and Compliance (GRC) are discovering—often the hard way—that yesterday's frameworks are increasingly inadequate for today's complex threat landscape.
Consider this. When the World Economic Forum recently surveyed global executives, the most pressing concerns they identified—from AI disruption to supply chain vulnerabilities—weren’t neatly contained within traditional GRC boundaries. These risks cascade across organizational silos, render conventional approaches obsolete, and demand a fundamentally different way of thinking about organizational resilience.
Moving Beyond the GRC Mindset - Why Boards Must Rethink Risk for the AI Era
I’m often questioned—sometimes challenged and occasionally attacked—by professionals who are deeply invested in traditional Governance, Risk, and Compliance (GRC) approaches. For many, GRC isn’t just a framework or a set of tools—it’s an identity, a career foundation, and in many cases, a commercial interest. So when I suggest that risk management must evolve beyond legacy GRC models, I’m not just raising a strategic argument—I’m challenging a belief system.
But this is not about abandoning GRC. It’s about recognizing that GRC, in its traditional, siloed, compliance-first form, is no longer sufficient for today’s risk environment.
AI's Risk Reckoning: How Integrated Risk Management Can Prevent Catastrophe
Organizations must adopt a structured, enterprise-wide approach to AI risk governance to balance AI's opportunities and risks. Integrated Risk Management (IRM) provides the governance framework to manage AI risks holistically, aligning AI implementation with corporate strategy, regulatory compliance, cybersecurity, and operational resilience.
The Future of Risk Management - How AI Agents Are Transforming IRM
Artificial Intelligence (AI) agents are revolutionizing Integrated Risk Management (IRM) by enabling organizations to detect, analyze, and mitigate risks autonomously. Unlike traditional risk management frameworks that rely heavily on manual assessments and static controls, AI-driven solutions enhance speed, accuracy, and adaptability, reducing financial losses, security breaches, and compliance failures.
Bridging the Resilience Gap: Why Integrated Risk Management Outperforms Legacy GRC Solutions
A recent KPMG Risk & Resilience Survey (March 2025) has revealed a concerning reality: most U.S. organizations remain unprepared to handle increasing risk events and broad disruptions. The report highlights that two-thirds to nearly three-quarters of organizations face moderate to strong barriers to managing risk effectively. The survey findings confirm a critical gap in how organizations manage risk and, more importantly, where traditional Governance, Risk, and Compliance (GRC) technologies fall short.
Distilled Intelligence or Compressed Catastrophe? The High-Stakes Risks of Shrinking AI
Their is a great deal of hype about distilled AI, an emerging technique that trims down massive machine learning models into leaner, cheaper versions. While these distilled “student” models may look—and sometimes perform—much like their full-fledged AI counterparts, a closer inspection reveals a labyrinth of potential flaws: from amplified bias and reduced accuracy to hidden legal liabilities.
The Digital Risk Paradox - Why Corporate Digitalization Could Be Your Biggest Liability
Digital transformation has long been heralded as the corporate world's silver bullet—promising efficiency, resilience, and competitive advantage. However, emerging research suggests a more unsettling reality: the rush to digitalize may create as many risks as it mitigates.
Citi's $81 Trillion Error Highlights Urgent Need for Stronger Integrated Risk Management
The startling news that Citigroup mistakenly credited a client’s account with $81 trillion instead of a mere $280 underscores a critical weakness pervasive in today’s financial institutions: insufficiently robust integrated risk management (IRM) systems. This incident, termed a “near miss” by Citi, reveals deep-seated operational vulnerabilities that continue to plague banks, despite considerable investment and regulatory scrutiny.
The Myth of Internal Audit Independence: Why It’s Time to Evolve Beyond GRC Thinking
The debate over the true independence of internal audit (IA) has resurfaced with new urgency following the recent high-profile firings of multiple inspectors general (IGs). Government IGs in the United States operate in similar ways to IA in private-sector organizations. Given their similarity, these IG dismissals have sparked controversy within the IA community, with critics arguing they threaten government oversight and accountability. The situation underscores a long-standing issue: IA and IGs are not truly independent, and continuing to believe otherwise does more harm than good.
What the Public Sector Can Learn from the Private Sector’s Embrace of Integrated Risk Management
While risk management is not new to government institutions, the public sector lags behind the private sector in adopting a truly integrated approach. The world’s leading corporations have embraced IRM as a critical framework for anticipating threats, enhancing resilience, and driving long-term value creation. It is time for the public sector to take a page from the private sector’s playbook.
How Companies Can Employ AI for Compliance and Risk Management—Safely and Effectively with IRM
To fully realize AI’s potential while mitigating its risks, organizations must adopt an Integrated Risk Management (IRM) approach that provides governance, oversight, and strategic alignment between AI deployment and risk management objectives. IRM ensures that AI-driven compliance processes are not only efficient but also secure, transparent, and adaptable to regulatory changes.
The CISO Storm: Why the Role Must Evolve into the Chief Digital Risk Officer
The Chief Information Security Officer (CISO) is at the center of the storm—a whirlwind of cyber threats, regulatory demands, digital transformation, and fragmented risk management practices. Once a purely technical role, the CISO has been forced into a high-stakes balancing act, trying to secure not just IT infrastructure but the entire digital ecosystem of modern enterprises.
Meanwhile, cyber risk has become the defining business risk of the digital age. Yet, most organizations still treat the CISO as an IT specialist rather than a true enterprise risk leader. The problem isn’t just how CISOs are perceived—it’s that they are stuck in a broken system.