GRC insights
Notes from the compliance trenches
Regulatory updates, framework walkthroughs, and practical notes for governance, risk, and compliance practitioners.
Everybody Is at Level 3
Run a maturity self-assessment across a large organisation and the results cluster in the middle with suspicious consistency. It is not that everyone is genuinely at the same level. It is that the middle is the safest place to stand. Here is what the levels are supposed to mean and why the jump to level 4 is the one that actually costs something.
Red, Amber, Green Is Not a Number
Someone on the board asks what the exposure is worth, and the heat map cannot answer. It was never built to. Here is what goes wrong when ordinal scales get treated as arithmetic, what quantifying a risk actually involves, and which risks are not worth quantifying at all.
The Supplier You Never Signed a Contract With
Three of your critical vendors go down on the same morning. None of them are competitors, none share an owner, and nothing in your register connects them. They were all running on the same platform underneath. Here is why fourth-party concentration is invisible to most vendor programmes, and what it takes to see it.
One GRC Programme, Many Jurisdictions: Structuring for Multi-Entity Groups
When entities in a group answer to different regulators, most organisations either force one standard on everyone or let each entity run its own programme. Both fail. Here is the structure that works.
Map Once, Satisfy Many: How Control Mapping Actually Works
Most organisations answer to several frameworks at once and end up maintaining a separate control set for each. Here is how a single control library with proper mapping removes that duplication, and where the approach genuinely breaks down.
ISO 27001 and NIST CSF Together: Where They Overlap and Where They Don't
Plenty of organisations run both. They are not competing standards and they are not interchangeable: one is a certifiable management system, the other is a risk-outcome language. Here is how they fit together in one programme.