Nadia Crawford on changing perceptions of risk, building credibility through continuous learning, and why effective risk management starts long before a decision reaches the risk team.
Putting people at the heart of your risk programs
Many risk leaders begin their careers in governance, compliance, or audit. Nadia Crawford’s route was different.
Starting in process improvement, her natural curiosity led her into discussions about controls, compliance, and how organizations manage change. Over time, that evolved into a career in enterprise risk management, risk culture, and risk leadership.
Throughout the latest Spotlight on Women in GRC podcast, one theme came through consistently: effective risk management is ultimately about people. Risk frameworks, policies, and reporting matter, but success depends on how well organizations engage people, encourage challenge, and create cultures where risk is understood rather than feared.
In a business environment where regulatory change, AI adoption, cyber threats, and operational disruption continue to accelerate, that challenge has never been more important. According to PwC’s Global Risk Survey, organizations are facing increasingly interconnected risks and need risk functions that provide timely insight and support better decision-making, rather than operating solely as oversight functions.
Rebranding risk for better engagement
One of Nadia’s strongest messages is that risk and change are inseparable. Implementing effective risk management is rarely just a process exercise. It’s a cultural transformation:
“It takes time. It’s not just a process change per se. It’s a cultural shift.”
Nadia Crawford, CRO and Head of ERM
That cultural shift can be difficult because many employees still associate risk functions with obstacles, escalations, or people who say “no.”
Nadia believes risk leaders need to actively challenge that perception.
Rather than positioning risk as a control function that appears at the end of a project, risk teams should be viewed as collaborative partners that help the business succeed safely and sustainably: “We have to be there from the beginning… from inception of an idea all the way through to production.”
That approach is supported by wider industry research. PwC found that only around half of risk leaders are involved in early transformation discussions, despite widespread agreement that risks are managed more effectively when risk professionals are included during planning and design rather than after decisions have been made.
Early engagement helps organizations:
- Avoid costly rework
- Identify dependencies sooner
- Improve decision-making
- Reduce implementation delays
- Strengthen stakeholder confidence
This aligns closely with CoreStream GRC’s value-based GRC philosophy. Risk delivers the greatest value when it helps shape decisions, not when it reviews them after the fact.
Learn more about our Objectives@Risk methodology.
Capturing the wins to demonstrate the risk team’s value
Part of rebranding risk means highlighting positive outcomes. Many risk teams spend significant time preventing problems that never become visible, as a result, stakeholders often see the effort but not the value.
Nadia advocates recognizing and communicating successes as they happen:
- Where risk involvement saved time
- Where controls prevented rework
- Where issues were identified early
- Where regulatory concerns were addressed before becoming incidents
- Where client trust or reputation was protected
Those outcomes help demonstrate that risk is not simply an administrative function. It is a business enabler. Like GRC pundit, Michael Rasmussen says:
“Risk management must move from risk-centric language to value-centric language. The business does not need to be trained to speak risk. Risk professionals need to learn to speak the language of the business.”
Nadia Crawford, CRO and Head of ERM
Being comfortable with difficult conversations as a risk professional
Of course, effective risk management is not always comfortable. Strong risk cultures depend on challenge, accountability, and constructive disagreement.
As Nadia explains:
“I don’t believe there’s a GRC professional out there that hasn’t had a hard conversation with a colleague from the first line of defense or from any other control area.”
Nadia Crawford, CRO and Head of ERM
Rather than avoiding those moments, risk professionals need to embrace them as part of the role.
Research from Deloitte defines a risk-intelligent culture as one where employees understand the organization’s approach to risk, take personal responsibility for managing it, and encourage others to do the same. Importantly, that kind of culture cannot be created through policies alone. It requires ongoing communication, leadership reinforcement, and behavioral change.
Risk reporting that drives action across the business
For Nadia, reporting plays a critical role in shaping engagement with risk. Too often, organizations focus on delivering information rather than driving decisions:
“In order to have action, you have to have some context as to why it’s needed.”
Nadia Crawford, CRO and Head of ERM
The most effective reports connect information with action. That means:
- Explaining why an issue matters
- Demonstrating potential impact
- Connecting risks to business objectives
- Including forward-looking insights
- Balancing lessons learned with future forecasting
Deloitte’s guidance on risk culture measurement makes a similar point, emphasizing that meaningful reporting combines quantitative metrics with qualitative context, helping leaders understand not just what is happening, but why it matters and what should happen next. If risk reporting only measures activity, organizations may struggle to understand whether they are actually becoming more resilient.
Learning and curiosity will keep you ahead in risk
While culture was one major theme of the discussion, the second was continuous learning. For Nadia, learning is not optional for risk professionals. It is a responsibility, but shouldn’t be a daunting one, as “you learn everywhere” from your daily news, LinkedIn feeds, peer to peer conversations, desk research and more. This is needed as the pace of change facing risk leaders continues to accelerate. Organizations are managing emerging technology, regulatory change, geopolitical uncertainty, cyber threats, operational resilience requirements, and evolving stakeholder expectations simultaneously.
According to the World Economic Forum’s Future of Jobs Report 2025, advances in AI, automation, and digital technologies are among the most transformative forces reshaping organizations, while demand for technological literacy, analytical thinking, resilience, and continuous learning continues to grow.
Learning builds trust and credibility for risk leaders
Continuous learning isn’t just about knowledge acquisition, it also strengthens credibility. Nadia highlighted an important lesson that many professionals learn over time:
“Having that mindset of just comfortability within your domain and your subject matter expertise, that helps with building credibility, but also with building trust.”
Nadia Crawford, CRO and Head of ERM
Interestingly, that credibility does not come from pretending to know everything, rather:
“Being able to say, I don’t know… and leaning with your partners in trying to figure something out or just tell me more about this.”
Nadia Crawford, CRO and Head of ERM
That willingness to stay curious often creates stronger relationships than attempting to position yourself as the smartest person in the room. The best risk professionals understand both their expertise and their limitations. They know when to challenge, when to collaborate, and when to seek additional perspectives. Creating partnerships with other departments like compliance, legal, HR, IT etc, enables greater synergy and outcomes.
Staying ahead of emerging risk and forecasting effectively in the AI era
Nadia recommends resources such as Bloomberg, GRC Certify, and LexisNexis to help stay informed about developments that may impact risk environments. Maintaining that awareness becomes even more important as organizations increase their use of AI.
“GRC professionals, we just have to continue keeping up with AI, what’s out there in the industries that we work in and utilizing it to our advantage.”
Nadia Crawford, CRO and Head of ERM
AI presents significant opportunities for efficiency, productivity, and decision support. However, Nadia emphasizes that innovation must be balanced with governance.
“Using it to our advantage while at the same time ensuring that when we use it, our risk environment does not change for the negative.”
Nadia Crawford, CRO and Head of ERM
That balanced view reflects challenges many organizations are currently facing. McKinsey’s State of AI research found that AI adoption continues to increase rapidly, but many organizations are still working to strengthen governance, risk management, and controls as AI becomes more deeply embedded into business operations. Risk leaders understand that AI is not solely an IT issue, and must ensure the rest of the business grasps that is a core governance capability too.
Conclusion: embracing change to become a true risk leader
One of Nadia’s most memorable observations was simple:
“You cannot afford to stay behind.”
Nadia Crawford, CRO and Head of ERM
Whether building risk culture, supporting business transformation, improving reporting, or governing emerging technologies, modern risk leadership requires constant adaptation. An effective GRC culture is built by creating stronger partnerships, embedding risk awareness earlier, welcoming constructive challenge, and helping organizations make better decisions.
As Nadia’s experience demonstrates, the most effective risk professionals combine technical expertise with curiosity, credibility, and a willingness to keep learning.
About Nadia Crawford
Nadia Crawford is a governance, risk and compliance leader with more than 15 years of experience across financial services, SaaS, business process outsourcing (BPO), government and public-sector environments. Throughout her career, she has worked across both first- and second-line risk functions and has helped organizations build enterprise risk management frameworks, governance structures and risk programmes from the ground up.
About Spotlight on Women in GRC
Spotlight on Women in GRC is a podcast series created to continue the conversations sparked by the Women in GRC Awards 2026 and carry those insights beyond the event. Backed by key sponsor CoreStream GRC and hosted by Lucy Montague, the series shines a light on the women shaping governance, risk and compliance, exploring their backgrounds, experiences and perspectives on what is changing across the industry.
Frequently asked questions about effective risk management and building a risk culture
An effective risk culture is one in which people across the organization understand risk, take responsibility for managing it, and feel able to raise concerns or challenge decisions. It depends on clear communication, leadership support, constructive conversations, and risk awareness embedded in everyday decision-making.
Organizations can strengthen risk culture by involving risk teams early, connecting risk to business objectives, encouraging open challenge, recognizing positive outcomes, and reinforcing personal accountability. Policies and frameworks matter, but lasting change comes from consistent leadership behavior and employee engagement.
A risk team can demonstrate value by showing where its involvement prevented rework, identified issues earlier, reduced delays, protected reputation, or supported better decisions. Communicating these outcomes in business language helps stakeholders see risk management as an enabler rather than an administrative function.
Effective risk reporting explains why an issue matters, its potential impact, how it relates to business objectives, and what action is needed. The strongest reports combine relevant metrics with qualitative context and forward-looking insight so leaders can make informed decisions.
Continuous learning helps risk professionals keep pace with regulatory change, cyber threats, operational disruption, geopolitical uncertainty, and emerging technology. It also builds credibility by enabling them to ask better questions, work confidently with specialists, and recognize when further expertise is needed.
Risk management helps organizations adopt AI responsibly by identifying potential impacts, defining appropriate controls, clarifying accountability, and monitoring how AI changes the risk environment. Risk leaders should be involved early so innovation, governance, and business value develop together.
Condensed podcast transcript of Spotlight on Women in GRC: CRO, Nadia Crawford
Lucy Montague: Welcome to Spotlight on Women in GRC. Today I’m joined by Nadia Crawford. Nadia, could you introduce yourself and tell us a bit about your current role and career journey?
Nadia Crawford: I’ve worked in GRC for around 15 years across financial services, SaaS, BPO and public sector environments. I’ve worked in both first and second line roles, helping organizations build and mature risk, governance and compliance capabilities. What originally drew me to GRC was curiosity. I ask a lot of questions, especially “why?” Starting in process improvement naturally led me toward compliance, risk and governance because I wanted to understand how organizations make decisions and manage uncertainty.
Building risk functions and creating culture
Lucy Montague: You’ve built enterprise risk frameworks and governance programs from the ground up. What have those experiences taught you?
Nadia Crawford: The biggest lesson is that risk transformation is never just about changing processes. It’s a cultural shift. Change takes time, and organizations need patience to embed new ways of working. The technical framework is only one part of the journey. Getting people to think differently about risk is the real challenge.
Lucy Montague: How do you make risk management something people actually want to engage with?
Nadia Crawford: Many people hear “risk” or “compliance” and immediately think of roadblocks, delays or someone telling them no. The key is helping people understand the why behind the work. Risk and compliance functions should be seen as partners, not adversaries.
GRC teams need to be involved from the beginning of projects and strategic decisions, not brought in at the end. When risk professionals are involved early, they can help save time, avoid costly rework and protect the organization from reputational, financial and customer impacts.
Reporting risk to leadership
Lucy Montague: What separates a risk report that drives action from one that simply provides information?
Nadia Crawford: Effective reporting requires both information and action. Some leaders want detailed context, while others want clear actions. The best reporting provides enough information to explain why something matters, while also making it clear what decisions or actions are required.
It’s also important to understand your audience. Different stakeholders consume information differently, but everybody needs enough context to understand why action is necessary.
Lucy Montague: How much focus should organizations place on looking forward versus looking back?
Nadia Crawford: Both matter. Organizations need to understand what has happened in the past, learn from it and prevent issues from reoccurring. At the same time, those lessons should inform future planning and forecasting. Looking backwards and forwards are equally important parts of effective risk management.
Leadership and developing future talent
Lucy Montague: What qualities do you look for in future leaders?
Nadia Crawford: The biggest things I look for are initiative, curiosity and a hunger for growth. Technical skills can often be taught, but those characteristics are much harder to develop.
For women especially, I look for people willing to contribute, even when they may be the only woman in the room. I’ve often found myself as the only woman, and sometimes the only minority person, in discussions. It takes courage to challenge ideas, share perspectives and contribute confidently in those environments.
Lucy Montague: How do you identify that in interviews?
Nadia Crawford: I look at both their career progression and the questions they ask. I want to see evidence that they’ve built on previous experiences and applied what they’ve learned. During interviews, I also pay close attention to the quality of their questions. Great candidates are interviewing the organization just as much as the organization is interviewing them.
Navigating bias and imposter syndrome
Lucy Montague: Have you experienced biases or barriers during your career?
Nadia Crawford: Absolutely. Everyone encounters biases in some form. What’s important is being comfortable with what you know while remaining humble enough to acknowledge what you don’t know.
Being able to say “I don’t know” and then work collaboratively to find the answer builds credibility and trust. Women in GRC can sometimes be labeled as too assertive or too passionate, but I don’t believe we should make ourselves smaller to be more accepted.
There’s a reason we’re in those rooms and at those tables. We’ve earned those opportunities through our knowledge, experience and hard work. We have to push imposter syndrome aside and remember that.
A proud career moment
Lucy Montague: Can you share a moment that made you particularly proud?
Nadia Crawford: One of my most rewarding experiences was bringing together two teams that were working toward similar goals but in very different ways. Over time, we built a shared vision, common processes and a unified risk function.
The most satisfying part wasn’t the processes. It was seeing people grow. Watching team members become more confident, challenge ideas, contribute new thinking and support one another was incredibly rewarding. Seeing a team become self-sustaining is one of the most fulfilling aspects of leadership.
AI governance and the future of GRC
Lucy Montague: You’ve helped establish AI governance programs. What’s the biggest risk organizations are overlooking?
Nadia Crawford: One of the biggest mistakes is treating AI as though it operates in isolation. Organizations often focus on the immediate benefits and efficiencies without considering the wider consequences if something goes wrong.
The real risk is failing to consider the broader impact across interconnected processes, teams and systems. Leaders need to step back and view AI within the wider organizational ecosystem rather than as a standalone tool.
Lucy Montague: What will define the next era of GRC?
Nadia Crawford: AI will absolutely be part of it. Risk professionals need to stay informed, adapt and learn how to use emerging technologies effectively. Risk itself isn’t going away. The challenge will be ensuring that organizations leverage new technologies without creating unnecessary exposure or weakening their risk environment.
Why choose a career in GRC?
Lucy Montague: What would you say to graduates considering a career in governance, risk and compliance?
Nadia Crawford: Risk will always exist, which means GRC will always be relevant. The profession requires curiosity, analytical thinking and a willingness to learn continuously.
It isn’t simply about policies or spreadsheets. It involves understanding businesses, connecting dots, influencing people and sometimes having difficult conversations. GRC is a career for people who enjoy learning because the learning never stops.
Staying ahead of change
Lucy Montague: How do you stay up to date?
Nadia Crawford: You have to make time for professional development. I learn through industry publications, webinars, professional networks and conversations with colleagues across different sectors.
One of the best ways to stay ahead is to build relationships with other professionals. Often, regulatory or risk trends emerge in one industry before appearing elsewhere. Continuous learning is essential because GRC professionals simply cannot afford to fall behind.
Career advice
Lucy Montague: What career advice has stayed with you throughout your career?
Nadia Crawford: Don’t think of your career as a straight line. Careers zigzag. Sometimes you move sideways to move forward. Sometimes what looks like a setback becomes one of the most valuable learning opportunities you’ll have.
Every role should teach you something that you can apply to the next. As long as you’re learning and growing, you’re moving in the right direction.
Lucy Montague: Thank you so much for joining us today, Nadia.
Nadia Crawford: Thank you for having me. It’s been a pleasure.
