The Leadership Role That Shaped My Life
Twenty-nine years ago today, I sat for my Eagle Scout Board of Review. I remember less about the room and more about what it represented. I do not recall the room layout, the…
Trail Map
Notes from the trail
Notes on technology risk, compliance and leadership. A lot of them start on a trail.
Filter
No posts match those filters.
Stop Handing Auditors and Examiners Puzzle Pieces
Most audit and regulatory friction isn’t caused solely by missing controls. It happens when risk, control design, testing, and regulatory expectations are not explained as a…
Metrics for Compliance Program "Awakening"
Most compliance programs are built to pass assessments, not to manage risk over time. Assessment metrics are necessary, but they only tell you whether controls were present, not…
Cargo-Cult Controls: When the Form Remains but the Function Is Gone
Cargo-culted controls persist because they look right, not because they still reduce risk. The smell test exposes them: if the control disappears and the risk collapses, the story…
Appreciating the Journey
“At times our own light goes out and is rekindled by a spark from another person. Each of us has cause to think with deep gratitude of those who have lighted the flame within us.”…
Be Prepared: Turning Risk Awareness into Intentional Practice
Most organizations assess risk instinctively but rarely do so intentionally. Proactive risk management means embedding foresight directly into daily decision - making. Regulations…
Not understanding the risk is how you get a raccoon in your tent
Framework assessments measure compliance; risk assessments reveal exposure. Frameworks and regulatory requirements provide valuable structure, but neither replaces true risk…
The Photo-Op Fallacy: Why MVP Thinking Fails in Risk Management
The concept of the Minimum Viable Product (MVP) was meant to drive learning and adaptation - not minimal compliance. In risk management and regulatory remediation, MVP often…
From Boardroom to Server Room: Connecting the Two Governance Conversations
Somewhere along the way, governance became two different conversations - one in the boardroom and one in the server room. If you’ve ever sat in a meeting where half the room…
Four Common Risk Management Pitfalls
Last week, I shared an analogy in Is Your Risk Program on the Right Path? that looks at risk management like planning your hike. Risks are points of interest, control objectives…
Is Your Risk Program on the Right Path?
Imagine standing at the trailhead with a topographic map in hand. The map shows you the terrain—the hills, valleys, ridges, and rivers that make up the landscape. But there are no…
Switchbacks Over Shortcuts: Building Processes That Endure
Every organization has processes, whether formal or not. Some are like well-marked trails—safe, efficient, and reliable. Others are dirt shortcuts—useful in the moment, but risky…
Applying lessons learned from Dan Heath's "Upstream" to Technology Risk Management
I recently finished reading Upstream: The Quest to Solve Problems Before They Happen by Dan Heath, and it was a great reminder of how much impact we can have by addressing issues…
