Author: Corey
-
How to put objectives at the center of your risk management program
Read more: How to put objectives at the center of your risk management programOrganizations do not exist to manage risks. They exist to achieve objectives. Yet too many risk programs are still built around the risk register. Teams spend countless hours identifying, scoring, and reviewing risks, only to be left with a list of red, amber, and green ratings that offer little insight into what leaders actually need…
-
XapienConnect 2026 key takeaways: what true transformation in due diligence looks like
Read more: XapienConnect 2026 key takeaways: what true transformation in due diligence looks likeThe end of the experimental era: what true transformation in due diligence looks like At this year’s Xapien Connect 2026, one message came through loud and clear: AI enables business transformation. For the last few years, organizations have been focused on AI experimentation. Pilot projects. Proofs of concept. Internal debates about what AI might mean…
-
Spotlight on Women in GRC: What global logistics teaches us about the future of compliance
Read more: Spotlight on Women in GRC: What global logistics teaches us about the future of complianceLila Landis on building compliance across 100 countries, winning stakeholder support through influence rather than authority, and ensuring GRC helps organizations move faster rather than slowing them down. In the latest Spotlight on Women in GRC podcast, host Lucy Montague speaks with Lila Landis, Global Head of Compliance at JAS Worldwide, a global freight forwarder,…
-
The PHP2Shell vulnerability shows why third-party risk management must move at the speed of attackers
Read more: The PHP2Shell vulnerability shows why third-party risk management must move at the speed of attackersCritical PHP vulnerabilities put most of the web at risk and left customers asking suppliers 1 question. Here’s what PHP2Shell teaches third-party risk management teams about supplier assurance. Key takeaways from the PHP vulnerability alert Introduction: “are you affected?” the question every supplier was asked In the days after 21 October, CoreStream GRC’s customer success…
-
Spotlight on Women in GRC: Building an effective risk culture with a Chief Risk Officer
Read more: Spotlight on Women in GRC: Building an effective risk culture with a Chief Risk OfficerNadia Crawford on changing perceptions of risk, building credibility through continuous learning, and why effective risk management starts long before a decision reaches the risk team. Putting people at the heart of your risk programs Many risk leaders begin their careers in governance, compliance, or audit. Nadia Crawford’s route was different. Starting in process improvement,…
-
Hackers turned French supermarket fridges into ovens: who owns the risk in your building and equipment controls?
Read more: Hackers turned French supermarket fridges into ovens: who owns the risk in your building and equipment controls?Attackers overheated fridges in hundreds of French supermarkets using flaws flagged months earlier. Here’s what it teaches risk and compliance teams about legacy equipment and supplier risk. Key takeaways from the French supermarket hack Introduction: when freezers became ovens On the morning of Monday 12 October, staff at 100s of supermarkets across France found aisles…
-
2026 risk review: the forecasts were right, so why were so few organizations ready?
Read more: 2026 risk review: the forecasts were right, so why were so few organizations ready?Gartner, PwC, Deloitte and the WEF identified 2026’s biggest risks. We compare their forecasts with what really happened, and ask why so few organizations were ready. Key takeaways Introduction: the risks that were missed Picture a risk committee meeting in late January 2026. Near the front of the board pack sits a single line lifted…
-
EU AI Act in practice: bringing data protection into your action plan
Read more: EU AI Act in practice: bringing data protection into your action planMost organizations are treating the EU AI Act as a standalone compliance project. That’s a mistake. If your AI systems process personal data, AI compliance doesn’t sit in its own silo. Treating these responsibilities separately risks duplicated work, inconsistent controls and gaps in accountability. Data protection, governance, risk management, audit and compliance all have a…
-
The ASOS breach shows why customer messaging platforms belong in your third-party risk management framework
Read more: The ASOS breach shows why customer messaging platforms belong in your third-party risk management frameworkHackers used ASOS’s own app to announce its data breach. Here is what the attack, and the retailer’s response, teach GRC teams about third-party risk and incident response. Key takeaways from the ASOS data breach incident Introduction: the risk consequences when the breach notice comes from the attacker At around 10am on Tuesday 6 October,…
-
IT risk/ISO27001/NIS2/SOC 2
Read more: IT risk/ISO27001/NIS2/SOC 2What is IT risk? IT risk is the risk that technology systems, data, infrastructure, people, or digital processes could fail, be disrupted, be misused, or expose the organization to harm. It includes risks linked to cybersecurity, system availability, data confidentiality, access controls, third parties, operational resilience, regulatory compliance, and technology change. In governance, risk, and…