Glossary
-
Spotlight on Women in GRC: Building an effective risk culture with a Chief Risk Officer
Read more: Spotlight on Women in GRC: Building an effective risk culture with a Chief Risk OfficerNadia Crawford on changing perceptions of risk, building credibility through continuous learning, and why effective risk management starts long before a decision reaches the risk team. Putting people at the heart of your risk programs Many risk leaders begin their careers in governance, compliance, or audit. Nadia Crawford’s route was different. Starting in process improvement,…
-
Hackers turned French supermarket fridges into ovens: who owns the risk in your building and equipment controls?
Read more: Hackers turned French supermarket fridges into ovens: who owns the risk in your building and equipment controls?Attackers overheated fridges in hundreds of French supermarkets using flaws flagged months earlier. Here’s what it teaches risk and compliance teams about legacy equipment and supplier risk. Key takeaways from the French supermarket hack Introduction: when freezers became ovens On the morning of Monday 12 October, staff at 100s of supermarkets across France found aisles…
-
2026 risk review: the forecasts were right, so why were so few organizations ready?
Read more: 2026 risk review: the forecasts were right, so why were so few organizations ready?Gartner, PwC, Deloitte and the WEF identified 2026’s biggest risks. We compare their forecasts with what really happened, and ask why so few organizations were ready. Key takeaways Introduction: the risks that were missed Picture a risk committee meeting in late January 2026. Near the front of the board pack sits a single line lifted…
-
EU AI Act in practice: bringing data protection into your action plan
Read more: EU AI Act in practice: bringing data protection into your action planMost organizations are treating the EU AI Act as a standalone compliance project. That’s a mistake. If your AI systems process personal data, AI compliance doesn’t sit in its own silo. Treating these responsibilities separately risks duplicated work, inconsistent controls and gaps in accountability. Data protection, governance, risk management, audit and compliance all have a…
-
The ASOS breach shows why customer messaging platforms belong in your third-party risk management framework
Read more: The ASOS breach shows why customer messaging platforms belong in your third-party risk management frameworkHackers used ASOS’s own app to announce its data breach. Here is what the attack, and the retailer’s response, teach GRC teams about third-party risk and incident response. Key takeaways from the ASOS data breach incident Introduction: the risk consequences when the breach notice comes from the attacker At around 10am on Tuesday 6 October,…
-
IT risk/ISO27001/NIS2/SOC 2
Read more: IT risk/ISO27001/NIS2/SOC 2What is IT risk? IT risk is the risk that technology systems, data, infrastructure, people, or digital processes could fail, be disrupted, be misused, or expose the organization to harm. It includes risks linked to cybersecurity, system availability, data confidentiality, access controls, third parties, operational resilience, regulatory compliance, and technology change. In governance, risk, and…
-
Enterprise Risk Management (ERM) and ISO 31000
Read more: Enterprise Risk Management (ERM) and ISO 31000What is enterprise risk management (ERM)? Enterprise risk management (ERM) is the organization-wide process of identifying, assessing, managing, monitoring, and reporting risks that could affect strategic objectives. It gives leadership and the board a joined-up view of risk across the business, rather than leaving each function to manage risk in isolation. In governance, risk, and…
-
Risk assessment
Read more: Risk assessmentWhat is a risk assessment? Risk assessment is the process of identifying, analyzing, and evaluating risks so an organization can understand what might affect its objectives and decide what action is needed. It helps teams work out what could happen, how likely it is, how serious the impact could be, and whether the risk sits…
-
Risk mitigation
Read more: Risk mitigationWhat is risk mitigation? Risk mitigation is the process of reducing the likelihood or impact of a risk through controls, actions, safeguards, or changes to the way an organization operates. It is one type of risk response, alongside accepting, avoiding, sharing, or transferring risk. In governance, risk, and compliance (GRC), risk mitigation matters because identifying…
-
Risk appetite vs risk tolerance
Read more: Risk appetite vs risk toleranceRisk appetite vs risk tolerance is the difference between the level of risk an organization is willing to take in pursuit of its objectives and the specific level of variation it can accept before action is needed. Risk appetite is usually broader and strategic. Risk tolerance is usually more specific, operational, and measurable. In governance,…